473,837 Members | 1,646 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Protect local Mysql DB access

Hi,

I just password-protected an intranet site by including a password
authentication script in each page of a private section. The script
checks the login against the mySQL database. Appropriate file
permissions have been set up on the private directory.

My concern is now about protecting the Mysql password. Let's assume I
use Apache to protect the access to this password (<files></files> or
SetEnv in httpd.conf).

In my intranet directory, I have a public folder where I let users put
their html/php files to build their own pages.

How can I prevent a user from creating a php file like this :

$conn = mysql_connect($ _SERVER['SQL_DB'],$_SERVER['SQL_USER'],$_SERVER['SQL_PASS'])
or die(mysql_error ());

$sql = 'update user set private_access= '1' where username =
'myself'';
$result = mysql_query($sq l) or die(mysql_error ());

In that way, without knowing the Mysql pwd, any user can finally have
access to the private section.

Can anyone tell me how I can manage this ?

Thanks !
Jul 17 '05 #1
2 2361
In article <b7************ **************@ posting.google. com>, Flier_75 wrote:
How can I prevent a user from creating a php file like this :

$conn = mysql_connect($ _SERVER['SQL_DB'],$_SERVER['SQL_USER'],$_SERVER['SQL_PASS'])
or die(mysql_error ());

$sql = 'update user set private_access= '1' where username =
'myself'';
$result = mysql_query($sq l) or die(mysql_error ());

In that way, without knowing the Mysql pwd, any user can finally have
access to the private section.


Read the MySQL manual on access rights.
Add an account that has only rights on the columns/tables/databases it
should have (Thus excluding thet private_access column in this case).

--
Tim Van Wassenhove <http://home.mysth.be/~timvw/contact.php>
Jul 17 '05 #2
Tim, thanks but if I use an account that for instance doesn't have
access to the columns "private_access " and "user_password" , then how
could I do if I want the users be able to change their password from
my php pages ?
These php pages use one and only one $_SERVER['SQL_USER'] account.

Tim Van Wassenhove <eu**@pi.be> wrote in message news:<2i******* *****@uni-berlin.de>...
In article <b7************ **************@ posting.google. com>, Flier_75 wrote:
How can I prevent a user from creating a php file like this :

$conn = mysql_connect($ _SERVER['SQL_DB'],$_SERVER['SQL_USER'],$_SERVER['SQL_PASS'])
or die(mysql_error ());

$sql = 'update user set private_access= '1' where username =
'myself'';
$result = mysql_query($sq l) or die(mysql_error ());

In that way, without knowing the Mysql pwd, any user can finally have
access to the private section.


Read the MySQL manual on access rights.
Add an account that has only rights on the columns/tables/databases it
should have (Thus excluding thet private_access column in this case).

Jul 17 '05 #3

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

11
4207
by: Mike MacSween | last post by:
My client has an MS Access database application on her local machine. I have full access to that in terms of changing the design. I've got a simple PHP/MySql application on shared hosting, so no direct access to the db server. I'd like to give her the facility to export the information in her local Access application to the shared PHP/MySql site. From one command button (or similar) in the Access application.
0
2412
by: Bill Hernandez | last post by:
Hi, I've been writing software on the mac since 1987, but am brand new at unix/php/mysql, and that's where I'm headed so I'm reading everything I can get my hands on, but like anything else there's going to be a learning curve, that having been said... I followed the install instructions at http://entropy.ch , and was able to get mySql & php installed on my G4 -> (OSX 10.2.6) last night. I downloaded Navicat and setup a password for...
3
1906
by: Shank | last post by:
I need to harvest data from MySQL tables. My experience is with MSSQL and Enterprise Manager. I also connect to MSSQL with Access and ODBC. I don't need to manage anything. I just need the data. What kind of interface can I use to query and save data locally? I don't see any MySQL drivers available when I try to setup an ODBC from my desktop. Can I download one somewhere? thanks!
1
6996
by: McKirahan | last post by:
What is "active content"? My ASP page just returns HTML.... I have a page with an .htm extension that has a form whose action is an ASP page which generates a report after updating a database with the form data. Under Windowx XP SP2 the IE6 "Information Bar" has the message: "To help protect your security, Internet Explorer has restricted this
1
121543
by: jiing | last post by:
Now let me describe what I have done and my purpose: Originally, I want to user ports to install phpBB But I found that phpBB doesn't support mysql 5.x (but the ports installed mySQL 5.0.0 alpha) so I deinstall mysql5-server and mysql5-client And then I install mysql41-server and mysql41-client on FreeBSD 5.3 by ports but now , mysql is not workable
1
16091
by: Ray in HK | last post by:
What are the differences between LOAD DATA INFILE and LOAD DATA LOCAL INFILE ? I found some web hosting company do not allow using LOAD DATA INFILE but allow LOAD DATA LOCAL INFILE. The reason is for the sake of security. What does that mean ?
22
5837
by: teejayem | last post by:
Hi, I am new to programming with databases and was wanting some help. Is there any way to password protect an access database and access sent sql commands to it via vb.net code? Any help would be much appreciated. Thanks in advanced.
8
3851
by: mouac01 | last post by:
I'm not sure if this is possible. I would like to have a PHP app on the Internet connect and write to a local database (Intranet). For example, users would go to a web site http://www.internet.com to run the app. The app requires an internet connection and is outside of the user's network. The app would have the option to either store data locally or on the Internet. I would like to give users the option to store data locally because...
6
6332
by: markodilore | last post by:
Hey Guys, you helped me once when I tryied to create a database : "Access denied for user ''@'localhost' ". On my Mac OS 10.4, I had no problem creating database and modifying it from the terminal. But I use Dreamweaver 8 to connect to MySQL, with its built-in feature "MySQL Connection" I write this: Connection Name: con_test001 MySQL Server: localhost User Name: root Password: 55555 Database: test001 (which is a database I already...
0
9683
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...
0
10883
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...
0
10579
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...
1
10633
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...
0
9412
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...
0
5674
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
1
4479
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
2
4050
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.
3
3126
bsmnconsultancy
by: bsmnconsultancy | last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.