CODEWITHSUNDEEP
phpsecuritydatabase-connectionpear
Markus Ossi
Markus Ossi

Reputation: 109

PEAR:DB connection parameters

I just finished my first PHP site and now I have a security-related question. I used PEAR:DB for the database connection and made a separate parameter file for it. How should I hide this parameter file?

I found a guide (http://www.kitebird.com/articles/peardb.html) that says:

Another way to specify connection parameters is to put them in a separate file that you reference from your main script. ... It also enables you to move the parameter file outside of the web server's document tree, which prevents its contents from being displayed literally if the server becomes misconfigured and starts serving PHP scripts as plain text.

I have now put my file in a directory like this /include/db_parameters.inc

However, if I go to this URL, the web server shows me the contents of the file including my database username and password.

From what I've understood, I should protect this file so, that even though PHP would be served as text, nobody could read this.

What does outside of web server's document tree mean here? Put the PHP file out of public_html directory altogether deeper into the server file system? Some CHMOD?

Upvotes: 0

Views: 203

Answers (3)

kguest
kguest

Reputation: 3844

Outside the document tree means the file should not be in the document root or any subfolder of the document root. You could set up a rule in an .htaccess file to prohibit access to db_parameters.inc and leave it inside the document tree, but that's probably an exercise best left for another day.

Upvotes: 0

Powerlord
Powerlord

Reputation: 88796

/include/db_parameters.inc in this case is a URI, corresponding to a real path like /var/www/include/db_parameters.inc The part before the /include is the document root. PHP stores the current document root in $_SERVER['DOCUMENT_ROOT']

In this case, to be outside the document root would be a file in a directory other than the one mentioned above.

Upvotes: 1

Mike Keller
Mike Keller

Reputation: 615

You could try /include/db_parameters.inc.php also include a blank index.php/html file in that directory to prevent anyone from being able to see what is contained in the directory.

Upvotes: 0

Related Questions