PHP and MySQL Security for a Newb

[Xizor]

Ok, I'm new to PHP and MySQL. I've been going through tutorials, reading the
documentation, and looking through web sites. PHP to me seems great! With
MySQL it seems even better.

However, I'm an experienced C++ programmer. This has allowed me to see many
potential areas where the security of a server can be compromised through
loopholes in PHP. Granted, with the right knowledge these potential threats
can be avoided. But I've just started and while I may have found some,
certainly I haven't seen all or at least the most common mistakes.

So then, what I'm asking for is a list, based on the experiences of the PHP
and MySQL community at large, of potential areas to watch out for. Basically
a Dos and Don'ts list, mostly with the Don'ts. If there is a web site that
is consider the source for this sort of info, please let me know. I have
seen many, but so far have not found a definitive one.

Also, I have some specific questions:

Everytime I connect to a database, I have to supply a username and password
in my PHP file (duh). This bothers me, cause it seems like someone could
easily find there way to this file. I guess I have two questions. A normal
user on the web with no special access to my server (assuming they don't
have some weird backdoor they found) can't view the PHP file, right? Because
it is executed and translated on the server end before every leaving the
server to go to the user and pop up on their browser. They can't somehow get
at the original source or get the password to the database, right?

If I do give somehow access to the server (let's say using FTP), I have to
make sure not to give them access to my PHP stuff. If they do want their own
database, what should I do? I'm assuming the best course of action is to
create a database for them and a new MySQL username for them, giving only
that username access to that database.

Thanks for help.

[Louis-Philippe Huberdeau]

If you really are into security, the most important part is to validate
every single entry. When processing a form, validate that it come from
your website. Validate the data and where it came from.

Don't show filenames on the outside. Many beginners do stuff like:
page.php?content=thatpage.inc
Which is obviously unsecure.

Ad for the MySQL part. You have to provide the username or password, if
you don't want to, you can use defautl ones but that's just less secure.
It depends on what kind of website you are working on, but if you use a
user table, make sure the passwords are hashed using either md5 or sha1.
Encrypt and/or obfuscate the email adresses and credit card numbers(if
any). That way, even if someone gain acces to your database, the data
will be safe. If only an administration section can modify the data in
the database, you might want to place that administration on an other
server using SSL connection, or even better, make it accessible only
from local access (of course, that restrains flexibility). Pages that
only view data should use a restrained MySQL connection (which can only
read, or write trivial informations).

Make backups often, don't keep informations you don't need. Destroy old
credit card numbers you don't need anymore as soon as you can.

There are different levels of security, what do you need it for?

Xizor wrote:

Ok, I'm new to PHP and MySQL. I've been going through tutorials, reading the
documentation, and looking through web sites. PHP to me seems great! With
MySQL it seems even better.

However, I'm an experienced C++ programmer. This has allowed me to see many
potential areas where the security of a server can be compromised through
loopholes in PHP. Granted, with the right knowledge these potential threats
can be avoided. But I've just started and while I may have found some,
certainly I haven't seen all or at least the most common mistakes.

So then, what I'm asking for is a list, based on the experiences of the PHP
and MySQL community at large, of potential areas to watch out for. Basically
a Dos and Don'ts list, mostly with the Don'ts. If there is a web site that
is consider the source for this sort of info, please let me know. I have
seen many, but so far have not found a definitive one.

Also, I have some specific questions:

Everytime I connect to a database, I have to supply a username and password
in my PHP file (duh). This bothers me, cause it seems like someone could
easily find there way to this file. I guess I have two questions. A normal
user on the web with no special access to my server (assuming they don't
have some weird backdoor they found) can't view the PHP file, right? Because
it is executed and translated on the server end before every leaving the
server to go to the user and pop up on their browser. They can't somehow get
at the original source or get the password to the database, right?

If I do give somehow access to the server (let's say using FTP), I have to
make sure not to give them access to my PHP stuff. If they do want their own
database, what should I do? I'm assuming the best course of action is to
create a database for them and a new MySQL username for them, giving only
that username access to that database.

Thanks for help.

[Jason Cutting]

Whatchyoo talkin `bout, Louis-Philippe Huberdeau?

Ad for the MySQL part. You have to provide the username or password, if
you don't want to, you can use defautl ones but that's just less secure.

As far as MySQL is concerned, use a separate machine for it, and only
allow queries from the server. That's pretty secure.

--
Caution: breathing may be hazardous to your health.