a better approach than storing mysql password in plain text in config file?

user_142018 0
Viewed 27551

It's always bothered me that many PHP programs require the user to store the mysql password in plain text (in a string or constant) in a configuration file in the application's root.

Is there any better approach to this after all these years?

So far I have come up with two minimal security boosts:

  1. make the file unreadable via the web using rules in .htaccess (in case php fails or there's a security vulnerability to read php source)

  2. destroy the password in memory after the db connect is made (unset) (to prevent string dumps from a security breach, injection, etc.)

but of course neither of those solve the original problem.

Thanks for any other ideas!

passwords security mysql php
8 Answers

You can set enviroment variables in .htaccess file, for example:

SetEnv DBuser sesame
SetEnv DBpass street

And later in your code read, use and delete the entries.

user_116730340
Related