1

So I'm storing my MySQL database connection login info in a .php file that's above the web root.

But if someone gains access to the whole server, they could potentially open that file up

What else can I do to protect the info?

Improve this question

3 Answers 3

Reset to default
5

If someone has access to your entire production webserver, I figure you would have bigger issues than hiding your MySQL database credentials.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

2

You cannot do anything against the person who got the access to the server.

Improve this answer

2 Comments

You can slap them if they are local :P
@alex: unless they are bigger and/or stronger than you in which case alternative approaches are advised
2

Besides the obvious answers, you should ensure your site is safe from directory traversal attacks that may read your PHP file above the root.

Make sure you don't do this (or similar)

echo file_get_contents($_GET['page']);

(better example than previous)

Improve this answer

2 Comments

If its a php file then this will execute the file and an attacker will not be able to see its contents.
@Rook Yeah, the similar would be echo file_get_contents($_GET['page']);.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.