I need to connect to a MSSQL database from PHP. However, as a server on a remote site is connected, I require the connection to be encrypted.
Is it possible to use encrypt the connection to the MSSQL server using only mssql extension for PHP or alternatively PDO?
There is 3 things that are important when implementing a secure (encrypted) connection to MSSQL:
The options Encrypt and TrustServerCertificate are often used together.
By default the SQL server installs a self-signed certificate that it will use to encrypt connections - the self signed certificate are however open to attacks. So it should be replaced with one from a certificate authority (CA).
After replacing your certificate, you then set Encrypt = true and TrustServerCertificate = false (TrustServerCertificate = true will also work, but your connection will then be vulnerable to attacks)
Code-example from article *1:
$serverName = "serverName";
$connectionInfo = array( "Database"=>"DbName",
"UID"=>"UserName",
"PWD"=>"Password",
"Encrypt"=>true,
"TrustServerCertificate"=>false);
$conn = sqlsrv_connect( $serverName, $connectionInfo);
If you use PDO create an object and pass the relevant params.
For a more detailed explanation please see the following article:
*1 - http://blogs.msdn.com/b/brian_swan/archive/2011/03/08/sql-server-driver-for-php-connection-options-encrypt.aspx
Related
TLDR: I'd like to connect a php application to a MS SQL server through an active directory account but haven't had much luck finding documentation on how to do that.
Most of the issues that people seem to have with this are pretty complicated I think I just don't have a strong enough grasp of the concept. When I try to connect it to the server, I get:
Warning: mysql_connect(): No connection could be made because the target machine actively refused it.
The code I'm using is:
$user_name = "ADAccountName";
$pass_word = "ADAccountPW";
$datbase = "myDatabase";
$server = "#ipaddress#:#port#";
$db_handle = mysql_connect($server, $user_name, $pass_word);
$db_found = mysql_select_db($database, $db_handle);
I created a user "sa" through MS SQL Server Management Studio and attached it to an AD account (I don't seem to have access to create one without picking an AD account).
I've had luck connecting it to a database using MySQL Workbench (for testing) and a dedicated username/password, but the actual database I need to use is run by MS SQL Server Manager with an AD account. I've spent the greater part of the day going through forums and Microsoft's documentation on SQL Server Manager but I haven't found anything that can help me out with this.
I'm using php v. 5.2
Depending which version of PHP you are using you could do the following
resource mssql_connect ([ string $servername [, string $username [, string $password [, bool $new_link = false ]]]] )
URL - http://php.net/manual/en/function.mssql-connect.php
This would give you direct connection to the DB.
If you're trying to connect to MSSQL you will need to do a few things to your web server first.
1.You will need to add PHP to your windows startup
2.Then you will need to install SQL Server Native client
3.Install the SQL Server drivers for your web server. SQLSRV30 is for PHP 5.4, SQLSRV31 is for PHP 5.5
4.Then go to your php.ini file and enable these extensions.
This will enable you to use PHP Data Objects.
You can connect to the DB like this:
try
{
$conn = new PDO( "sqlsrv:server=$serverName ; Database=AdventureWorks", "sa", "");
$conn->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION );
}
catch(Exception $e)
{
die( print_r( $e->getMessage() ) );
}
I've been trying to connect to a SQL Server 2008R2 database using PDO in PHP, using this syntax:
$conn = new PDO('sqlsrv:Server=xxxxxx;Database=xxxxx', 'xxxxx', 'xxxxx');
but each time, I try to run a query, I get "exception 'PDOException' with message 'SQLSTATE[08001]: [Microsoft][SQL Server Native Client 11.0]Named Pipes Provider: Could not open a connection to SQL Server [2]. '"
But when I try using
$serverName = "xxxxx";
$connectionInfo = array( "UID"=>"xxxx",
"PWD"=>"xxxx",
"Database"=>"xxxxx");
$conn = sqlsrv_connect( $serverName, $connectionInfo);
The query is successful.
My PHPinfo() shows that sqlsrv is enabled in PDO drivers and the fact that sqlsrv_connect is working would seem to suggest that it's not a firewall or port opening issue. Username and password are identical in both cases.
Can anyone help suggest where I should be looking to get the PDO working, as I'd prefer to do it this way for consistency?
AAAARGHH, it was a syntax error in my PDO statement. Changed everything to lower case and it worked. Sorry, StackOverflow!
I need the guidance help on ODBC connection string in PHP, which I am using to connect to MS SQL Server.
<?php
$server = 'UKEMO03';
$database = 'mtpFetch';//the database to connect to
$user = 'shoabg';// the user has PERMISSIONS AT THE DATABASE
$pass = 'Shsx12x';//and here the user's password
$dsn = "Driver={SQL Server};Server=$server;Database=$database;";
$connect = odbc_connect($dsn, $user, $pass);
?>
Above code works treat, but i have a requirement of not to specify the username and password and use the connection string with Integrated Security. I can't find anything on internet and I can't change the connection string method because I've completed most of my work and by adapting another connection method will require a massive change in a code in theory its not an option for me.
Is there a way we can create Integrated Security connection to connect MS SQL Server in PHP using ODBC
Please help i don't know what to do
This will connect you to the ODBC master database (cathalog).
I did not succeed to connect to another database. There is an option for default database in the configuration of ODBC SDN, but has no effect
("Chenge the default database to").
$this->dbHandle = odbc_connect("Driver={SQL Server};Server=localhost;Integrated Security=SSPI", '', '');
If you use PHP ini make sure you use:
mssql.secure_connection=On
On the database server, make sure you have Windows Authentification associated with your login username
My environment:
- Windows Server 2008 R2.
- Apache Webserver.
- PHP 5.4.7
I've just downloaded and installed Microsoft Drivers 3.0 for PHP for SQL Server.
I've included "php_pdo_sqlsrv_54_ts.dll" into php.
Microsoft has included a helpful chm file with the drivers (SQLSRV_Help.chm).
In this help file there is a PDO example using windows authentication:
/* Connect using Windows Authentication. */
try {
$conn = new PDO("sqlsrv:server=$serverName ; Database=AdventureWorks", "", "");
$conn->setAttribute( PDO::ATTR ERRMOE, PDO::ERRMODE EXCEPTION );
}
But I have to connect to our MS SQL Server 2008 R2 using SQL Server Authentication!
What is the difference is between connecting to SQL Server
using PDO and Windows Authentication
using PDO and SQL Server Authentication
Is it just the connect string? Do I have to write:
$conn = new PDO("sqlsrv:server=$serverName; Database=AdventureWorks; UID=sa; PWD=abc");
or do I have to write:
$conn = new PDO("sqlsrv:server=$serverName; Database=AdventureWorks; User Id=sa; password=abc");
Thanks in advance
Update:
I found a resoure:
http://www.connectionstrings.com/sql-server-2008
There are optional second and third parameter in the constructor which specify the username and password as described here:
PDO::__construct
Creates a connection to a SQL Server database.
Syntax PDO::__construct($dsn [,$username [,$password
[,$driver_options ]]] )
Parameters
$dsn: A string that contains the prefix name (always sqlsrv), a colon,
and the Server keyword. For example "sqlsrv:server=(local)". You can
optionally specify other connection keywords. See Connection Options
for a description of the Server keyword and the other connection
keywords. The entire $dsn is in quotation marks, so each connection
keyword should not be individually quoted.
$username: Optional. A string that contains the user's name. To
connect using SQL Server Authentication, specify the login ID. To
connect using Windows Authentication, specify "".
$password: Optional. A string that contains the user's password. To
connect using SQL Server Authentication, specify the password. To
connect using Windows Authentication, specify "".
[...]
This implies that you can connect to SQL Server using PDO + SQL authentication like this:
$conn = new PDO(
"sqlsrv:server=$serverName ; Database=AdventureWorks",
"sa",
"strong password"
);
The connection options section also mentions that you cannot use UID and PWD parameters in connection strings when using PDO_SQLSRV.
Using the PHP drivers from Microsoft, we cannot connect using either Windows Authentication or SQL Server authentication. We use the following PHP code:
$serverName = "(A\B)";
$connectionInfo = array( "UID"=>"u1",
"PWD"=>"p1",
"Database"=>"db1");
$conn = sqlsrv_connect( $serverName, $connectionInfo);
In a nutshell the php sql server stuff is terrible.
The only reliable solution (and I am forced to use SQL Server 2008 here for a very complex project) is using PHP ADODB.