A newbie here… As I go through this book (build your own database driven site php/mysql) I wondered how is the password that you put into the mysqli_connect function ($link = mysqli_connect(‘localhost’, ‘root’, ‘supersecretpassword’) protected?
What prevents someone else from looking at your .php file and seeing it?
I’m only on page 185 so if it’s answered later in the book just let me know and I’ll be patient.
thanks, mark
Basically, the assumption is that noone except you or webserver that executes your scripts can see their source. That is one of reasons why you should be extra careful with file permissions, temporary backup files tha IDEs sometimes create and shared hosting as such, because more often than not they are poorely configured.
What do you mean when you say “the IDEs sometimes create”. What’s IDE in this context?
Integrated Development Environment, like Eclipse, NetBeans, PhpStorm or any editor you use to do your programming. Some editors create backups of files you edit and name them with other extension than .php - if you upload all directory, then they get uploaded to server along with changed files and typical server setup returns files with unknown extension as text/plain - thus the attacker can make an educated guess and try to download file that along exposing internal logic (and possibly vulnerabilities) also exposes credentials you are using to access DB.
thanks for the explanation! mark
You can put the config file above the web root folder - then even if PHP were to get turned off for some reason people would still be unable to see the password hard coded in that file.