database security

[The Little Guy]

I have a file that contains all the database connection information, how could I hide that in a safe place and only allow files within a certain folder to have access, and no sub folders unless I specify which ones.

[Cep]

What is the file type? If its php its already hidden, php will only output code, if you tell it too.

[The Little Guy]

well... I'm allowing people to upload files, such as php, and if they find out the name and location of the file, they could possibly get the contents of the file and hack my database.

[Cep]

How are you allowing uploads?

Via a script? FTP accounts? Your not making any sense.

If your using FTP you can restrict where FTP users can go on your sites folder structure, this has nothing to do with PHP though its purely how you run FTP on your site.

PHP scripts for uploading don't allow any kind of view of your entire folders/files structure they just simply create a copy of the uploaded file and move it from the temp directory to the destination directory set out in the script.

[HuggieBear]

Firstly, It's a bad idea to allow people to upload files into the same folder as your connect page.

Secondly, even if they have the name of your connect.php page, they can't view any of the details by running it as it's enclosed in PHP's tags, meaning it gets executed server side.

Regards
Huggie

[The Little Guy]

[quote author=HuggieBear link=topic=121909.msg502360#msg502360 date=1168533124]
Firstly, It's a bad idea to allow people to upload files into the same folder as your connect page.
[/quote]
Its not in the same folder.


[quote author=Cep link=topic=121909.msg502355#msg502355 date=1168532818]
Via a script? FTP accounts? Your not making any sense.
[/quote]
I'm using a script.

basically what I'm saying, is if someone found the name of the file of all the database connection information, all they would  need to do is this (example):

include"/connect.php";
mysql_query("drop table table_name");

[Ninjakreborn]

?Put it in a folder outside the root?
ANother thing is if they are allowed to upload php file's, set chmod them so tehy cannot be executed, or automatically change hte <?php ?> tags to html entities to prevent them from running, change them back when they are needed.

[Cep]

Well no you couldn't use,

include"/connect.php";
mysql_query("drop table table_name");

Your connection script must have some sort of variable or function that stores the connection call, so without that function name or variable the above script would turn around and say "What table", "What database" and as they cannot physically view the information contained within the connect.php how are they ever going to know?

[HuggieBear]

Not necessarily true... Some connect scripts actually carry out the connect itself by just including it, rather than needing to call a function within it from another script, for those that do that, a simple [i]mysql_list_tables()[/i] will get you started.

Regards
Huggie

[The Little Guy]

the database info:
[code]
<?php
$dbHost = "localhost";    //Location Of Database usually its localhost
$dbUser = "xxxxx";        //Database User Name
$dbPass = "xxxxx";        //Database Password
$dbDatabase = "file_host";      //Database Name

$db = mysql_connect("$dbHost", "$dbUser", "$dbPass") or die ("Error connecting to database.");
mysql_select_db("$dbDatabase", $db) or die ("Couldn't select the database.");
?>
[/code]

One way of how I use it:
[code]
<?php
include"db.php";
$sql = mysql_query("SELECT * FROM users WHERE id='{$_SESSION['id']}'")or die(mysql_error());
$row = mysql_fetch_array($sql);
?>
[/code]

[corbin]

You could do like uhhh:

[code=php:0]
<?php
$dbHost = "localhost";    //Location Of Database usually its localhost
$dbUser = "xxxxx";        //Database User Name
$dbPass = "xxxxx";        //Database Password
$dbDatabase = "file_host";      //Database Name

function dbconn($str) {
if($str == "corbin345") {
$db = mysql_connect("$dbHost", "$dbUser", "$dbPass") or die ("Error connecting to database.");
mysql_select_db("$dbDatabase", $db) or die ("Couldn't select the database.");
}
}
?>
[/code]

and then on a page you use it

[code=php:0]
<?php
include"db.php";
dbconn('corbin345');
$sql = mysql_query("SELECT * FROM users WHERE id='{$_SESSION['id']}'")or die(mysql_error());
$row = mysql_fetch_array($sql);
?>
[/code]

That way if you called to the function and the string was incorrect it would not execute... Only problem with this is, if they can include the file they can also fopen it, which would output the raw file and they would see the 'password'.

Another way you could do it would be
[code=php:0]
<?php
$dbHost = "localhost";    //Location Of Database usually its localhost
$dbUser = "xxxxx";        //Database User Name
$dbPass = "xxxxx";        //Database Password
$dbDatabase = "file_host";      //Database Name

function dbconn($str) {
if(!preg_match("/uploads_folder/", $_SERVER['SCRIPT_NAME'])) {
$db = mysql_connect("$dbHost", "$dbUser", "$dbPass") or die ("Error connecting to database.");
mysql_select_db("$dbDatabase", $db) or die ("Couldn't select the database.");
}
}
?>
[/code]

The only problem with that is... All the sudden someone uploads a file that has:

[code=php:0]
<?php
$content = "<?php include('db.php'); mysql_query("DO SOMETHING BAD"); ?>";
$han = fopen("../badfile.php", "w+");
fwrite($han, $content);
?>
[/code]
Then they simply go to the file they created in their browser and you're badword'd

Basically, if you allow users to upload PHP files be VERY VERY VERY careful... If you do not wish for users to be able to execute them, I suggest you do as someone already said and replace all <'s and >'s with &lt; and &gt; or something...

In my not so humble opinion, if you allow users to upload and execute PHP files, you're asking to be screwed over.

[The Little Guy]

I was given this:


[code]<?php

if(basename(__FILE__) == basename($_SERVER['PHP_SELF'])) send_404(); 

$dbHost = "localhost";        //Location Of Database usually its localhost
$dbUser = "xxxxx";                        //Database User Name
$dbPass = "xxxxx";                        //Database Password
$dbDatabase = "file_host";              //Database Name

$db = mysql_connect("$dbHost", "$dbUser", "$dbPass") or die ("Error connecting to database.");
mysql_select_db("$dbDatabase", $db) or die ("Couldn't select the database.");

function send_404()
{
    header('HTTP/1.x 404 Not Found');
    print '<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">'."\n".
    '<html><head>'."\n".
    '<title>404 Not Found</title>'."\n".
    '</head><body>'."\n".
    '<h1>Not Found</h1>'."\n".
    '<p>The requested URL '.
    str_replace(strstr($_SERVER['REQUEST_URI'], '?'), '', $_SERVER['REQUEST_URI']).
    ' was not found on this server.</p>'."\n".
    '</body></html>'."\n";
    exit;
}

?> [/code]