php 如何保护项目中的数据库配置文件？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/14952853/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How to secure database configuration file in project?
提问by Kalpana Dixit
I have created on php file for establishing connection with database server. In this file, i am using mysql_connect()function with parameters host, username and password of my database server.
我已经在 php 文件上创建了与数据库服务器的连接。在这个文件中，我使用了mysql_connect()带有参数主机、用户名和我的数据库服务器密码的函数。
public class DatabaseConnect
{
function __construct()
{
mysql_connect('localhost','username','password') or die('Could not connect to mysql server.');
mysql_select_db('databasename');
}
}
Now in this case, username and password are visible to others.
现在在这种情况下，其他人可以看到用户名和密码。
I found one more way to secure the value i.e. mysql.default_userand mysql.default_password. In which scenario we have to this way?
我找到了另一种保护值的方法，即mysql.default_user和mysql.default_password。在哪种情况下我们必须这样？
Or how could i secure my values from others?
或者我怎样才能从他人那里获得我的价值观？
采纳答案by Bud Damyanov
You can try to put your database credentials in separate file with proper UNIX permissions set, for example 644, and then include this file on top of your script.
您可以尝试将您的数据库凭据放在具有适当 UNIX 权限集的单独文件中，例如 644，然后将此文件包含在您的脚本之上。
The configuration.phpfile will look like:
该configuration.php文件将如下所示：
<?php
define (DB_USER, "mysql_user");
define (DB_PASSWORD, "mysql_password");
define (DB_DATABASE, "database_name");
define (DB_HOST, "localhost");
?>
Your original script will look something like this:
您的原始脚本如下所示：
require ("configuration.php");
public class DatabaseConnect
{
function __construct()
{
mysql_connect(DB_HOST,DB_USER,DB_PASSWORD) or die('Could not connect to MySQL server.');
mysql_select_db(DB_DATABASE);
}
}
回答by Fabian Schmengler
Now in this case, username and password are visible to others.
现在在这种情况下，其他人可以看到用户名和密码。
Only to those, that have access to your source code. This should not be a problem. But if you want to separate code and database credentials, make sure that the configuration file is located outside the web root.
只有那些可以访问您的源代码的人。这应该不是问题。但是，如果您想分离代码和数据库凭据，请确保配置文件位于 Web 根目录之外。
