Re: MYSQL and PHP

Hi,

It is unsafe to store any PHP code in .inc files, due to default Apache 
configuration. By default, web server will not process them with PHP but 
output to browser as plain text.

The solution widely used for this situation is to store PHP 
configuration files in .inc.php files, because fully working Apache + 
PHP will process this file through PHP Preprocessor and will not display 
plain text but will output formatted HTML.

--
Hostas.lt
KlientÅ aptarnavimas
http://www.hostas.lt




John Madden wrote:
> Hi,
>
> First off i'm not a PHP programmer but I would like to
> know the following: 
>
> Is it standard to use INC files to store MYSQL db
> connections settings (username and password)? 
>
> What else could you do to make this "safer" ?
>
> I presume Apache looks for files with extention
> "*.INC" and does not processes them, right ?
>
> Thanks you
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam protection around 
> http://mail.yahoo.com 
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> Watchfire named worldwide market share leader in web application security 
> assessment by leading market research firm. Watchfire's AppScan is the 
> industry's first and leading web application security testing suite, and 
> the only solution to provide comprehensive remediation tasks at every 
> level of the application. See for yourself. 
> Download a Free Trial of AppScan 6.0 today!
>
> https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
> --------------------------------------------------------------------------
>
>   


-------------------------------------------------------------------------
Sponsored by: Watchfire

Watchfire named worldwide market share leader in web application security 
assessment by leading market research firm. Watchfire's AppScan is the 
industry's first and leading web application security testing suite, and 
the only solution to provide comprehensive remediation tasks at every 
level of the application. See for yourself. 
Download a Free Trial of AppScan 6.0 today!

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
--------------------------------------------------------------------------