Re: MYSQL and PHP

[Mark Sanders <mark () cyanox nl>]

That is one of the most wrong assumptions.

Most apache configuration see .INC as plain/text. Which means if you 
have your db settings in there anybody can read them by just pointing 
the browser at them.

The best approach is to use a simple .php file that is not in your 
document root so not accessible from outside.

Even if you don't put it outside of your document root it will still be 
parsed as PHP. And as long as you don't print out your sensitive data it 
should never reach the browser.

John Madden wrote:
> Hi,
>
> First off i'm not a PHP programmer but I would like to
> know the following: 
>
> Is it standard to use INC files to store MYSQL db
> connections settings (username and password)? 
>
> What else could you do to make this "safer" ?
>
> I presume Apache looks for files with extention
> "*.INC" and does not processes them, right ?
>
> Thanks you
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam protection around 
> http://mail.yahoo.com 
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> Watchfire named worldwide market share leader in web application security 
> assessment by leading market research firm. Watchfire's AppScan is the 
> industry's first and leading web application security testing suite, and 
> the only solution to provide comprehensive remediation tasks at every 
> level of the application. See for yourself. 
> Download a Free Trial of AppScan 6.0 today!
>
> https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
> --------------------------------------------------------------------------
>
>
>
>   


-------------------------------------------------------------------------
Sponsored by: Watchfire

Watchfire named worldwide market share leader in web application security 
assessment by leading market research firm. Watchfire's AppScan is the 
industry's first and leading web application security testing suite, and 
the only solution to provide comprehensive remediation tasks at every 
level of the application. See for yourself. 
Download a Free Trial of AppScan 6.0 today!

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
--------------------------------------------------------------------------