Enable TLS certificate verification for AWS RDS MySQL - php

I use MySQL 5.7.17 on AWS RDS.
I encountered a strange behavior and I am looking for an explanation.
In short: I try to connect over SSL, with settings that I think should cause the connection to FAIL, but it succeeds!
The following PHP code succeeds to connect to the RDS instance over SSL:
<?
$HOST = "something.amazonaws.com";
$USER = "myuser";
$PASS = "mypass";
$connectionString = "mysql:host={$HOST};charset=utf8";
$options = [ ];
$options[PDO::MYSQL_ATTR_SSL_CA] = "LITERALLY THIS TEXT. DEFINITELY NOT A CERTIFICATE!";
$options[PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT] = false;
$conn = new \PDO($connectionString, $USER, $PASS, $options);
$sql = "SHOW STATUS LIKE 'Ssl_cipher'";
$stmt = $conn->prepare($sql);
$stmt->execute([ ]);
$stmt->setFetchMode(\PDO::FETCH_ASSOC);
$rows = $stmt->fetchAll();
print_r($rows);
The result I get:
Array
(
[0] => Array
(
[Variable_name] => Ssl_cipher
[Value] => AES256-SHA
)
)
Also, I found three pem files in /etc/ca-certificates/rds-mysql. I thought that PHP might be going there for some reason, so I deleted them, but the SSL connection still succeeds.
Note: if I delete the line that says $options[PDO::MYSQL_ATTR_SSL_CA] = "LITERALLY THIS TEXT. DEFINITELY NOT A CERTIFICATE!"; - it does NOT connect over SSL. So it appears that this option does have some impact.
My question is: how come it succeeds?

Related

Connect to MySQL database in PHP

I'm trying to build a blog website.
It is deployed on Heroku and it is supposed to connect to a MySQL database. The info required to login to my database is stored in an environment variable on Heroku, and looks like this (These are fake credentials of course):
mysql://g46w916ds134b8:639f463e#us-cdbr-east-03.cleardb.net/heroku_45fab1d19h35yetf?reconnect=true
It contains the DB name, the user, the password and the host.
Is there a way to use this one string directly in my PHP code to connect to the database? I checked MySQLi and PDO documentation, and it seems like they only accept DSN/user/password or Host/user/password/DBname format.
This is a url after all, so you can use parse_url function to extract data.
// Connection string from environmental variable in heroku
$connectionStringHerokuEnv = 'mysql://g46w916ds134b8:639f463e#us-cdbr-east-03.cleardb.net/heroku_45fab1d19h35yetf?reconnect=true';
$parsed = parse_url($connectionStringHerokuEnv);
$dbname = ltrim($parsed['path']. '/'); // PATH has prepended / at the beginning, it needs to be removed
// Connecting to the database
$conn = new PDO("{$parsed['scheme']}:host={$parsed};$dbname={$dbname};charset=utf8mb4", $parsed['user'], $parsed['pass'], [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
For database connection you should always use PDO and not mysqli driver. PDO allows you to connect to almost any database, without rewriting code in 85% of cases.
dont forget options [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION], this will allow you to catch any errors and handle them accordingly to application needs.
PDO accept this connection string driver: host=DATABASE_HOST;dbname=DATABASE_NAME; charset=DEFAULT_CHARSET(use utf8 whenever you can)
Learn more on parse_url: https://www.php.net/manual/en/function.parse-url
Learn more on PDO:
https://www.php.net/manual/en/class.pdo.php
<?php
$str = "mysql://g46w916ds134b8:639f463e#us-cdbr-east-03.cleardb.net/heroku_45fab1d19h35yetf?reconnect=true";
// If I correctly understanded 'mysql://login:passwd#host/dbname?some_params'
// data parsing from input string
$sp = explode('/', $str);
$sp1 = explode('#', $sp[2]);
$first_part_sp = explode(':', $sp1[0]);
$login = $first_part_sp[0];
$passwd = $first_part_sp[1];
$host = $sp1[1];
$dbname = explode('?', $sp[3])[0];
$connect_str = "mysql:host=$host;dbname=$dbname";
echo $connect_str." ".$login." ".$passwd;
// database access
$pdo = new PDO($connect_str, $user, $passwd);
?>

Moodle and Postgres - frequent database connection error

I've installed Moodle with Postgres. The db configuration looks like (yeah, I did it in a bit hackish way):
$CFG->dbtype = 'pgsql'; // 'pgsql', 'mariadb', 'mysqli', 'mssql', 'sqlsrv' or 'oci'
$CFG->dblibrary = 'native'; // 'native' only at the moment
$CFG->dbhost = "my-moodle-db.net' connect_timeout=10 sslmode=verify-full sslrootcert='/path/to/cas/allCAs.pem"; // eg 'localhost' or 'db.isp.com' or IP
$CFG->dbname = $pwd_name; // database name, eg moodle
$CFG->dbuser = 'moodle'; // your database username
$CFG->dbpass = $pwd_pwd; // your database password
$CFG->prefix = 'mdl_'; // prefix to use for all table names
$CFG->dboptions = array(
'dbpersist' => true, // should persistent database connections be
...
My installation works almost fine but once in roughly 10 requests I'm getting the following error:
Error: Database connection failed
And the page is rendered immediately though I set connection timeout to 10 above.
Is there any other place to fix connection timeouts in PHP?
Can I make moodle somehow retry the connection before returning the error to me?

php - PDO with wrong host uses localhost

I have a WAMP installation with Windows Server 2012 R2 Datacenter Edition, Apache 2.4.23, PHP 7.0.10 (mysqlnd 5.0.12-dev - 20150407), MySQL 5.7.14.
I configured a connection with:
$host = 'wrong-server';
$dbase = 'db_name';
$user = 'my_user';
$pwd = 'my_pwd';
$connection='mysql: host='.$host.'; dbname='.$dbase;
$link = new PDO($connection , $user, $pwd);
where wrong-server doesn't exsist (it is for a test for catching errors).
When I execute the code the connection works using localhost as host (I know it because a query to db_name retrive datas).
I searched for some default behaviour or configuration without succes.
Some ideas?
Code update:
<?php
$host = '192.168.123.123'; //'localhost';
$dbase = 'db_name';
$user = 'my_user';
$pwd = 'my_pwd';
$pdo_options[PDO::ATTR_ERRMODE] = PDO::ERRMODE_SILENT;
$connection='mysql: host='.$host.'; dbname='.$dbase;
try {
$link = new PDO($connection, $user, $pwd, $pdo_options);
$_SESSION['DB_INFO']=array( 'db'=>$link->getAttribute(PDO::ATTR_DRIVER_NAME),
'ver'=>$link->getAttribute(PDO::ATTR_SERVER_VERSION),
'cli'=>$link->getAttribute(PDO::ATTR_CLIENT_VERSION ),
'srv'=>$link->getAttribute(PDO::ATTR_SERVER_INFO ),
);
print_r($_SESSION['DB_INFO']);
}
catch(\PDOException $err) {
echo 'Error: '.$err->getMessage();
};
Server 192.168.123.123 doesn't exsist but I have these response:
Array ( [db] => mysql [ver] => 5.7.14 [cli] => mysqlnd 5.0.12-dev - 20150407 - $Id: 241ae00989d1995ffcbbf63d579943635faf9972 $ [srv] => Uptime: 20111 Threads: 1 Questions: 354 Slow queries: 0 Opens: 125 Flush tables: 1 Open tables: 118 Queries per second avg: 0.017 )
But if I set $pwd='wrong_pwd' the answer is:
Error: SQLSTATE[HY000] [1045] Access denied for user 'my_user'#'localhost' (using password: YES)
SOLUTION
As #MichaelBerkowski states, eliminating spaces in the DSN
mysql:host='.$host.';dbname='.$dbase.'
instead of
mysql: host='.$host.'; dbname='.$dbase.'
solves the problem, so an error came out.

Cannot get my php to process sqlsrv_connect on my GoDaddy Server

I have an android app that i am trying to get connected to my SQL Server.
I have tried countless ways of getting it to work by get a error on my sqlsrv_connect.
Here is the php im tyring to use. I have replaces my read server/credentials with *
<?php
$myServer = "***";
$myUser = "***";
$myPass = "***";
$myDB = "***";
//connection to the database
$conn = sqlsrv_connect($myServer, array('UID'=>$myUser, 'PWD'=>$myPass, 'Database'=>$myDB));
$_GET['search'];
//declare the SQL statement that will query the database
$query = "SELECT * FROM dbo.JD";
$data = sqlsrv_query($conn, $sql);
$result = array();
do {
while ($row = sqlsrv_fetch_array($data, SQLSRV_FETCH_ASSOC)){
$result[] = $row;
}
}while ( sqlsrv_next_result($data) );
echo(json_encode($result));
sqlsrv_free_stmt($data);
mssql_close($dbhandle);
?>
When processing on a php online test i get this error
Fatal error: Call to undefined function sqlsrv_connect() in [...][...]on line 7
Here my my php info
http://www.bakerabilene.com/phpinfo.php
It shows sqlsrv as a Registered PHP Streams so I don't understand why its not working.
I have also stripped my php down to where it just makes the connection to see if anything was causing the issue, but it still gives me that same error.
I am positive my server/user/pass/db are correct because i use the exact same credentials on my aspx webpage to access SQL server.
Check if the Native SQL Driver (Microsoft Drivers 3.0 for PHP for SQL Server) is installed . Have you asked the Godaddy Team about this ?

Connecting to Oracle with PHP on IIS

I'm having all sorts of trouble...
Here is the code I'm using:
$c = OCILogon('user', 'pass', 'host');
I get the following error:
PHP Warning: ocilogon(): ociopen_server: Error while trying to retrieve text for error ORA-12514 in D:\Inetpub\wwwroot**\oracle.php on line 26
Anyone know what the hell I'm doing wrong?
It's PHP4, IIS6 btw. I've tried this on PHP5, IIS7 as well, no luck.
Thanks for any help I can get... :(
You must have correctly configured TNSNAMES.ora file, where is stored information about connection to database. Oracle errorr ORA-12514 says:
TNS:listener does not currently know
of service requested in connect
descriptor
Function OCILogon have this syntax (I'am not PHP developer, so excuse me if I was not right):
resource oci_connect ( string
$username , string $password [,
string $connection_string [, string
$character_set [, int $session_mode
]]] )
In your example is on third position parametr "host". But manual says "connectin string".
This "connection string" must be coonfigured throught file $ORACLE_HOME/network/admin/tnsnames.ora file ($ORACLE_HOME is folder where is Oracle client installed).
TNSNAMES.ORA look like this(example):
TEST_DB = (DESCRIPTION =(ADDRESS_LIST
=(ADDRESS = (COMMUNITY = tcp.world)(PROTOCOL = TCP)(Host =
127.0.0.1)(Port = 1521)))(CONNECT_DATA = (SID = TESTDB_SID)))
Instead:
$c = OCILogon('user', 'pass', 'host');
You should use:
$c = OCILogon('user', 'pass', 'TEST_DB');
...TEST_DB is service name from tnsnames.ora file
And yet for complementing (my file $ORACLE_HOME/network/admin/sqlnet.ora look like this):
SQLNET.AUTHENTICATION_SERVICES= (NTS)
NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)
NAME.DEFAULT_ZONE = world
NAMES.DEFAULT_DOMAIN = world
And finally PHP manual example (connection string can be inserted directly into variables in PHP):
<?php
$db ="(DESCRIPTION =
(ADDRESS =
(PROTOCOL = TCP)
(HOST = HOSTNAMEHERE)
(PORT = 1521)
)
(CONNECT_DATA = (SID = SIDNAMEHERE))
)";
$odbc = ocilogon ('user', 'pass', $db) or die( "Could not connect to Oracle database!") or die (ocierror());
?>
try using persistant connection oci_pconnect()... worked for me

Categories