KnowledgeHub
Questions
Tags
Users
Search
Alex Rivera
|
Logout
Edit Question
Title
Body
It's always bothered me that many PHP programs require the user to store the mysql password in plain text (in a string or constant) in a configuration file in the application's root. Is there any better approach to this after all these years? So far I have come up with two minimal security boosts: make the file unreadable via the web using rules in .htaccess (in case php fails or there's a security vulnerability to read php source) destroy the password in memory after the db connect is made (unset) (to prevent string dumps from a security breach, injection, etc.) but of course neither of those solve the original problem. Thanks for any other ideas!
Tags (comma-separated)
Save Edits
Cancel