[Gerhard]

Newbie question:
If I connect to a mySQL database with php I have to write the access data into the php file,eg.:

$hostname = "my_host";
$username = "my_name";
$password = "my_pwd";
$dbName = "my_db";
$userstable = "my_table";
MYSQL_CONNECT($hostname,$username,$password) OR DIE("Unable to connect to database");

Is this secure ?

In other words: can it be read by a bad boy ?

Thanks in advance
Gerhard

[Sepodati]

No, but bad girls can read it...

Seriously, that's the joy of PHP. The code is parsed on the server, and only html is sent to the browser, so the person at the browser has no idea what your php code is.

I usually keep all of my database connections in a seperate file, database_inc.php, then include that file where ever I'll be connecting to a database

include("database_inc.php");

One warning about naming your file. If you name it something like database.inc, which is common, then if someone calls up the .inc file in their browser, it'll be shown to them as plain text. This will show your passwords. Either name your file .php or make sure .inc files are parsed as PHP, that way no code will be sent to the browser.

Another option is to place your .inc file outside of the web root, and include it like this:

include("../includes/database.inc")

That way, the page cannot be called up in a web browser because it's not in the web root.

Hope that helps.

---John Holmes...

------------------
************************
The manual can probably answer 90% of your questions.

PHP Manual: <A HREF="http://www.php.net/manual

MySQL" TARGET=_blank>http://www.php.net/manual

MySQL</A> Manual: <A HREF="http://www.mysql.com/documentation/mysql/bychapter/
************************" TARGET=_blank>http://www.mysql.com/documentation/mysql/bychapter/
************************</A>

[Gerhard]

Thanks a lot for your enlightment, John !

[Gerhard]

So if I understand right, the bad guy must:

- get an account on my server
- write an appropriate php or perl script

the data must be worth while to justify that (in my case they aren't)

Anyway, a "normal" surfer has no easy access to the php files, but I agree that this environment is not "secure".

What is the way to do it for sensible data ?

Thanks,
Gerhard