How to secure database passwords in PHP?

php database security
user18359 picture user18359 · Sep 19, 2008 · Viewed 213.7k times · Source

When a PHP application makes a database connection it of course generally needs to pass a login and password. If I'm using a single, minimum-permission login for my application, then the PHP needs to know that login and password somewhere. What is the best way to secure that password? It seems like just writing it in the PHP code isn't a good idea.

Answer

user11318 picture user11318 · Sep 19, 2008

Several people misread this as a question about how to store passwords in a database. That is wrong. It is about how to store the password that lets you get to the database.

The usual solution is to move the password out of source-code into a configuration file. Then leave administration and securing that configuration file up to your system administrators. That way developers do not need to know anything about the production passwords, and there is no record of the password in your source-control.

Related questions

Fastest hash for non-cryptographic uses?

I'm essentially preparing phrases to be put into the database, they may be malformed so I want to store a short hash of them instead (I will be simply comparing if they exist or not, so hash is ideal). I …

Read More
Warning: mysqli_connect(): (HY000/1045): Access denied for user 'username'@'localhost' (using password: YES)

Warning: mysqli_connect(): (HY000/1045): Access denied for user 'username'@'localhost' (using password: YES) in C:\Users\xampp\htdocs\PHP_Login_Script\config.php on line 6 Warning: mysqli_real_escape_string() expects parameter 1 to be mysqli, boolean given in C:\Users\…

Read More
Get the Last Inserted Id Using Laravel Eloquent

I'm currently using the below code to insert data in a table: <?php public function saveDetailsCompany() { $post = Input::All(); $data = new Company; $data->nombre = $post['name']; $data->direccion = $post['address']; $data->telefono = $post['phone']; $data->…

Read More