Working on a mobile app that needs to use a public API for accessing a database (but this won't affect the question).
Anyway, I am using PHP with MySQL and the Android/iPhone app will make POST requests to the PHP files. I am creating the connection to the database and wanted to create a class to do it. However, I am unsure where to put actual login credentials for the database.
I saw mention of outside the webroot so it's more secure. Should I then create a database class inside /lib that handles the connection and includes the config.inc.php file? Or do you guys recommend something totally different?
What you're proposing looks totally fine to me. A config file outside of the web root with a properly configured web server is, generally speaking, totally fine from a security point of view.
Related
I'm working on a website that is generated from a server. I have a php file where I include files that are stored on my computer and are necessary for the code to work. The files that I need are related to google calendar API like my credentials and a link to the API folder just like in the quickstart.php example of google (https://developers.google.com/google-apps/calendar/quickstart/php).
I think that storing these files on the server is not such a good idea. Is there a way for me to link local files from the server in an include or require? Or do I have to put everything on the server? And in that case how do I know the filepath to my files?
I am not in control of the server I just have acces to a small part of it. It is the school server and I'm working on one directory or so from that server so I can't do anything from root or so.
Thanks in advance and if my question is unclear please notify me so I can rephrase it.
If you want to protect the code from exposure, try PHP ionCube Encoder. So someone who has access to the server can't read the code, but still it will run correctly.
You CAN include remote files via HTTP if you can configure the server to set the following in the php.ini.
allow_url_include = On
This is NOT the normal setting as it could leave you more vulnerable to attacks. So this method is not a recommended one, but it is possible.
You should consider setting up an additional account on Google and then using that to work with. You can share the relevant calandars from your personal account with that account and thus protect yourself better.
Create a folder on your server outside of the public html folder. Go one directory above your website route directory and create your folder there. People will not be able to navigate to that new folder as it is outside of your website route. Store your sensitive files in the new folder. Then just require them in your normal files as needed. This protects your sensitive files in the event your PHP handler failed (rare but can happen) as the content of your sensitive files would not be displayed to people as plain text on your website. Remember to set appropriate folder and file ownership and permissions also on your server.
I'm new to this so please be gentle with me!
I have a PHP login page which connects to a MYSQL table (users) for validation
I need a username and password to initially access the table. eg:
$con = mysqli_connect('localhost','masteruser','masteruserpassword,'users');
Is it safe to keep the username and password coded in the PHP file. I'm thinking it is because the PHP file will never be 'served' only executed.
Any tips please
PHP code is executed on server So no need to worry about this.
Only processed output from the php code is delivered to the client side in form of response in html and js.
It's totally safe. But it will be much better, if you move it to config file
It's safe unless somebody reach your server.
For what it's worth, WordPress works this way. The database access credentials are in plain text in a file called wp-config.php in the installation's root directory. WordPress is probably the most widely deployed MySQL based web app there is. So you should be OK. WordPress seems to be working fine. :-)
BUT: practice defense in depth. Create a special MySQL account for your web app, and restrict its privileges to the MySQL database (or databases) your web app needs. Don't put a MySQL administrative account in there.
Also, make sure that account is restricted so attempts to connect from machines other than your web host will fail.
Thirdly, try to use a MySQL server machine that's behind a firewall, and only accessible to other machines in the same data center.
Finally, keep routine backups.
If you're using a typical commercial shared hosting service they take care of most of this for you (maybe not the backups).
That way, if somebody does manage to crack your server and look at your password, they'll have a hard time making use of it, and if they do make use of it they won't be able to damage much. If they do damage your app, you'll be able to restore it from backup.
I am going to make a simple web app. It will only have a few pages at most, and the main focus of the app is making calls to an api and doing stuff with that info.
I want to know what the best way is to keep my api key secure. Are there extremely lightweight frameworks that I can use for this? Should I just create a php page at the root? I could build something with codeigniter, but that seems like it is too much for what I need.
Keep the API key in a file outside of your web root. Then include that file in any file that will require its use. By placing it outside of the web root it cannot be accessed directly through a web browser or other similar means.
<?php
// Assuming this file is in the web root
require('../api_keys.php');
I am totally new to Flex mobile developing.
In FlashBuilder for PHP, you need to specify local PHP server.
My answer is, how to change it to remote server?
Because, i have a hosting, and I need to put files there, to make it public.
You never need a local server per say. Have you tried to look at the files that Flash Builder creates for you (if I remember correctly, in this case it creates a service-config.xml file)? There should be one that mentions ServiceObjects and an endpoint of localhost. You can change this to your remote location.
I personally don't like the xml approach to creating services since it doesn't give me the flexibility I want in the code. I much prefer having it in the code using the ServiceObject class and specifying the endpoint and destination there and using a delegate pattern to call my services. Something for you to look into :)
I have been wondering how secure a codeigniter setup is. Because information like db passwords etc is stored in config files in the main application folder could this be retrievable by hackers? I know you can move the application folder to a location away from the web root but is it still safe if you don't?
Also, even if you did move it some place else, the path to that other place is hardcoded into the index.php file that remains in the web root. I'm sure there is a simple explanation as to why it is safe, but could someone explain it to me?
I suppose that it depends on the hacker and the type of hack they are employing. If you're asking if some Joe Schmoe can view the config file settings from the web, then the answer is no. See Can a Client View Server Side PHP Source Code for more details.
If you're concerned that a hacker will break into your server for that kind of information, then you might want to invest some time in extending or overriding the native Database library and add some encryption for the database information as you read it from the configuration file. Or if you want to go completely hidden on the configuration, you could spend some time extending the Config class.
On the surface, CodeIgniter is as secure as any other PHP framework from the file sense. Place appropriate .htaccess rules and the web side should be just fine. That just leaves proper security of your web server.
Try running Google Skipfish against your app. See if it can sniff any lapses in security. The more likely case is your app using $_GET and $_POST variables directly in views, rather than the framework exposing your app to some risks.