Re: MYSQL and PHP

[Todd Hendricks <djtrubeliever () comcast net>]

Name your files "*.inc.php" to prevent apache from displaying them.  As 
added security, keep them out of the web root and access them using 
absolute paths (ie., if your webroot is /home/web/public_html/, store 
your includes in /home/web/includes).  If you must have your files below 
your webroot, make sure to use an .htaccess file to prevent access to 
the directory directly.  Combine these three tactics and you should be 
in good shape.

For server-level security in shared hosting environments, if your web 
host supports some sort of accelerator such as eaccelerator, ioncube, or 
zend encoder, encode your DB login information PHP files using that. 
And, as always, proper file ownership and permissions (user:apache, 640) 
are of primary importance.

- Todd

John Madden wrote:
> Hi,
>
> First off i'm not a PHP programmer but I would like to
> know the following: 
>
> Is it standard to use INC files to store MYSQL db
> connections settings (username and password)? 
>
> What else could you do to make this "safer" ?
>
> I presume Apache looks for files with extention
> "*.INC" and does not processes them, right ?
>
> Thanks you
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam protection around 
> http://mail.yahoo.com 
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> Watchfire named worldwide market share leader in web application security 
> assessment by leading market research firm. Watchfire's AppScan is the 
> industry's first and leading web application security testing suite, and 
> the only solution to provide comprehensive remediation tasks at every 
> level of the application. See for yourself. 
> Download a Free Trial of AppScan 6.0 today!
>
> https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
> --------------------------------------------------------------------------


-------------------------------------------------------------------------
Sponsored by: Watchfire

Watchfire named worldwide market share leader in web application security 
assessment by leading market research firm. Watchfire's AppScan is the 
industry's first and leading web application security testing suite, and 
the only solution to provide comprehensive remediation tasks at every 
level of the application. See for yourself. 
Download a Free Trial of AppScan 6.0 today!

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
--------------------------------------------------------------------------