munsiem Posted January 5, 2012 Share Posted January 5, 2012 I am by no means a security expert, but I would like to know if storing MySQL database information in an environment variable would be a good or bad idea. What are your thoughts? Quote Link to comment https://forums.phpfreaks.com/topic/254429-storing-sensitive-information-in-environment-variables/ Share on other sites More sharing options...
Adam Posted January 5, 2012 Share Posted January 5, 2012 By 'environment variable', do you mean putenv and getenv? I don't really see any benefit to this since they only exist for the life of the request. Quote Link to comment https://forums.phpfreaks.com/topic/254429-storing-sensitive-information-in-environment-variables/#findComment-1304587 Share on other sites More sharing options...
munsiem Posted January 5, 2012 Author Share Posted January 5, 2012 I am talking more about putenv. What I thought about doing is basically hiding the DB information by storing the info into an environment variable, like the following: $_ENV['database'] = array("connection" => array("username" => "root", "password" => "password", "hostspec" => "localhost", "database" => "database")); I thought it might be an interesting idea to hide the sensitive information a bit better, but what do you think? Quote Link to comment https://forums.phpfreaks.com/topic/254429-storing-sensitive-information-in-environment-variables/#findComment-1304608 Share on other sites More sharing options...
trq Posted January 5, 2012 Share Posted January 5, 2012 How exactly does this hide anything though? You would still need to include this file into every other fiel that requires a database connection. You could of course set the environment variables within your vhost config or .htaccess file, but still, these aren't exactly hidden. Quote Link to comment https://forums.phpfreaks.com/topic/254429-storing-sensitive-information-in-environment-variables/#findComment-1304632 Share on other sites More sharing options...
premiso Posted January 5, 2012 Share Posted January 5, 2012 If you are going to do that, why not just use the $_GLOBALS array? Either or, once you are doing initiating your connection, I would destroy that array index, but that is my preference. Generally, most people store it outside of the Document Root for safe keepings. But either or if your server is compromised via a rogue include or similar, your data is at risk, so that is just a matter of preference I guess. You are better to make sure that you have your bases covered on the security end over worrying where they should be put, imo. Quote Link to comment https://forums.phpfreaks.com/topic/254429-storing-sensitive-information-in-environment-variables/#findComment-1304636 Share on other sites More sharing options...
munsiem Posted January 5, 2012 Author Share Posted January 5, 2012 I have the file that stores the database connections private - basically the whole framework is sunk except for the public facing files (all models, controllers, views, and sensitive information have been removed from the htdocs). I was just curious if I had stored the database connection using an environment variable if that would be some kind of security issue. The main reason I ask is because earlier I did a phpinfo() and bam there was my database connection lol. I know of course that you wouldn't want to display phpinfo() to not let people know about your settings, but I just wanted to make sure that this wouldn't be as easily accessible anywhere else. I too believe that as long as you hide your sensitive information you would be safe, but I wanted to make sure that this environment variable wasn't going to be a major risk when storing my connections. Quote Link to comment https://forums.phpfreaks.com/topic/254429-storing-sensitive-information-in-environment-variables/#findComment-1304638 Share on other sites More sharing options...
laffin Posted January 5, 2012 Share Posted January 5, 2012 doesnt hide anything, as soon as someone can get a phpinfo(); into the script, the gig is up. and you will be fortunate if they are good guys and advise you of this gaping hole in security. Mpst likely tho, they will be a lookee loo, to see what they can see with your db passwords, and maybe enlist help to alter the database. Quote Link to comment https://forums.phpfreaks.com/topic/254429-storing-sensitive-information-in-environment-variables/#findComment-1304643 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.