On Fri, November 4, 2005 5:36 pm, bruce wrote:
> pablo...
>
> i fail to see how your suggestion is much more secure than placing the
> user/passwd information in a file that's outside the web access space,
> and
> then including the file.
>
> in either case, the user wouldn't be able to read the include file.
Sure they would!
<?php echo file_get_contents('/full/path/to/your/db_connect.inc');?>
If you manage to plug that hole, and you allow SymLinks in your
httpd.conf, and just for fun, you have .phps to show source in pretty
print, both of which can be quite USEFUL for many legitimate uses,
then:
cd ~/document_root
ln -s /full/path/to/your/db_connect.inc exposed.phps
http://example.com/~username/exposed.phps
I used to do that with one host (only in a password-protected web
directory) because it was easier than digging out the 32-character md5
hash password out of my Inbox for the internal database of cool
features I wasn't really supposed to have to worry about because they
were pre-built. It was an easier way to look up my own password than
the official correct way to do it. [shrug]
Look, if *YOUR* PHP script can read the file, and we're on a shared
server, then *MY* PHP script can read the file, unless the webhost has
gone above and beyond and set up separate httpd pools and usernames
and chroot'ed environments for everybody and all that... Which is
really hard to find at $20/month.
Hell, it's really hard to even find a webhost who knows enough about
security to even publish that they DO all that, much less for them to
find enough clients who know enough to know they WANT all that. Of
course, the thousands of webhosts who don't do that hardly want to
publish "Our Security sucks, but what do you want for $20?"
You have to weigh risk against benefits, though for some dinky little
site, and the probability that your co-hosted folks will be
malicious...
Odds are really not that bad, with shared hosts, compared to exposing
your username/password to the whole world in plain-text on the entire
'net.
Particularly if your webhost is vigilant with new clients and if they
have standards or a certain niche they can focus on, so they aren't
trying to be all things to all clients. I suspect this is a bigger
problem at larger hosts, particularly if their clients are tech-savvy
PHP geeks rather than, say, starving musicians.
--
Like Music?
http://l-i-e.com/artists.htm
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
