Posted on June 4, 2009 - by admin
How Do I Secure My Mysql Database?
I’m putting together a database (PHP/MYSQL) online, and I want to secure it from hackers.
I have heard of people hacking databases with “sql injection”, on mainstream CMSs like phpNuke.
Could those hackings be due to everyone knowing how the system works, and I would I be more safe because no one knows my database layout?
Any help or links would be great.
This entry was posted on Thursday, June 4th, 2009 at 5:41 am and is filed under SQl Injection. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Visit My Website
June 4, 2009
Permalink
There are some fundamental rules to follow:
1. Never use MySQL administrative accounts within your PHP code.
2. Create dedicated users. Let’s say that all requests which are read (and most of the requests you are going to run are going to be read only) have to be processes by a READ only MySQL user. And make sure this user only accesses needed databases and HAS NO ACCESS ON MySQL ADMINISTRATIVE DATABASES
3. Restrict MySQL user’s right to strict minimum (a bit like the above point)
4. Make sure the database is accessible with localhost only (or from specific users using specific IP addresses)
5. Hide PHP errors (they often give a lot of information on your system). Never let errors to be displayed on user’s end
6. Change password from time to time
7. Put a good firewall
8. Apply patches