How to obscure database info in PHP pages

[Lorenzo Thurman]

I'm moving from Cold Fusion to PHP and I have a question that none of
the books I have answers adequately:
In Cold Fusion, database connection parameters like the table, username
and password are configured on the server. Since they are at the
backend, nothing is exposed on the page except the queries themselves.
In PHP, from what I see, the database info is on the page. Is this not a
security risk? How can one be sure that this info is not on the page
sent to the user?
TIA

[Chris Hope]

Lorenzo Thurman wrote:

I'm moving from Cold Fusion to PHP and I have a question that none of
the books I have answers adequately:
In Cold Fusion, database connection parameters like the table, username
and password are configured on the server. Since they are at the
backend, nothing is exposed on the page except the queries themselves.
In PHP, from what I see, the database info is on the page. Is this not a
security risk? How can one be sure that this info is not on the page
sent to the user?

How is the database login info sent to the user? It's only going to be if
you write it out to html.

Consider the following:

<?php

$dbhost = 'localhost';
$database = 'foo';
$login = 'foo';
$password = 'bar';

....

$dbconn = mysql_connect($dbhost, $login, $password);
mysql_select_db($database, $dbconn);

?>

I can't see how any of that will be sent to the browser unless the page is
not saved with the appropriate extension eg .php - the only stuff between
<? and ?> tags that is sent to the browser is anything you "print" or
"echo".

--
Chris Hope - The Electric Toolbox - http://www.electrictoolbox.com/

[Tommy Gildseth]

Lorenzo Thurman wrote:

I'm moving from Cold Fusion to PHP and I have a question that none of
the books I have answers adequately:
In Cold Fusion, database connection parameters like the table, username
and password are configured on the server. Since they are at the
backend, nothing is exposed on the page except the queries themselves.
In PHP, from what I see, the database info is on the page. Is this not a
security risk? How can one be sure that this info is not on the page
sent to the user?

It is possible to set the database authentication details in the server
config with PHP. Have a look in php.ini, and the mysql.default_user,
mysql.default_password etc.

Tommy

[Tony Clarke]

Everything in the php tags (in a file with the php extension) gets processed
by the script processor server side so it will only ever appear as html (or
javaScript/VBScript) on the client side. You won't be able see any php
client side unless you have the wrong file extension, don't close the php
tags or don't have php installed & working properly on the server.

Tony.
"Tommy Gildseth" <gi*************@spam.start.no> wrote in message
news:cn**********@news.tdcnorge.no...

Lorenzo Thurman wrote:

I'm moving from Cold Fusion to PHP and I have a question that none of
the books I have answers adequately:
In Cold Fusion, database connection parameters like the table, username
and password are configured on the server. Since they are at the
backend, nothing is exposed on the page except the queries themselves.
In PHP, from what I see, the database info is on the page. Is this not a
security risk? How can one be sure that this info is not on the page
sent to the user?

It is possible to set the database authentication details in the server
config with PHP. Have a look in php.ini, and the mysql.default_user,
mysql.default_password etc.

Tommy

[Michael Vilain]

In article <cn**********@news.tdcnorge.no>,
Tommy Gildseth <gi*************@spam.start.no> wrote:

Lorenzo Thurman wrote:

I'm moving from Cold Fusion to PHP and I have a question that none of
the books I have answers adequately:
In Cold Fusion, database connection parameters like the table, username
and password are configured on the server. Since they are at the
backend, nothing is exposed on the page except the queries themselves.
In PHP, from what I see, the database info is on the page. Is this not a
security risk? How can one be sure that this info is not on the page
sent to the user?

It is possible to set the database authentication details in the server
config with PHP. Have a look in php.ini, and the mysql.default_user,
mysql.default_password etc.

Tommy

To elaborate further, Chris Shifflet has a great article on this:

http://shiflett.org/articles/security-corner-mar2004

--
DeeDee, don't press that button! DeeDee! NO! Dee...

[Lorenzo Thurman]

In article <vi**************************@news.giganews.com> ,
"Michael Vilain <vi****@spamcop.net>" wrote:

In article <cn**********@news.tdcnorge.no>,
Tommy Gildseth <gi*************@spam.start.no> wrote:

Lorenzo Thurman wrote:

I'm moving from Cold Fusion to PHP and I have a question that none of
the books I have answers adequately:
In Cold Fusion, database connection parameters like the table, username
and password are configured on the server. Since they are at the
backend, nothing is exposed on the page except the queries themselves.
In PHP, from what I see, the database info is on the page. Is this not a
security risk? How can one be sure that this info is not on the page
sent to the user?

It is possible to set the database authentication details in the server
config with PHP. Have a look in php.ini, and the mysql.default_user,
mysql.default_password etc.

Tommy

To elaborate further, Chris Shifflet has a great article on this:

http://shiflett.org/articles/security-corner-mar2004

Thanks, I'll check it out

--
"My Break-Dancing days are over, but there's always the Funky Chicken"
--The Full Monty

[Lorenzo Thurman]

In article <lh*******************@news.indigo.ie>,
"Tony Clarke" <cl*****@eircom.net> wrote:

You won't be able see any php
client side unless you have the wrong file extension, don't close the php
tags or don't have php installed & working properly on the server

Ok, I think I understand.

--
"My Break-Dancing days are over, but there's always the Funky Chicken"
--The Full Monty

[Lorenzo Thurman]

In article <11*************@216.128.74.129>,
Chris Hope <bl*******@electrictoolbox.com> wrote:

I can't see how any of that will be sent to the browser unless the page is
not saved with the appropriate extension eg .php - the only stuff between
<? and ?> tags that is sent to the browser is anything you "print" or
"echo".

OK, makes sense, thanks.

--
"My Break-Dancing days are over, but there's always the Funky Chicken"
--The Full Monty