放置 PHP 的 MySQL 连接详细信息的最安全位置在哪里
通过 PHP 脚本连接时，放置 MySQL 数据库连接详细信息的最安全位置在哪里？
$connection = mysql_connect($hostname, $username, $password);
if (!$connection) {die('Could not connect: ' . mysql_error());}
mysql_select_db($database, $connection);
我知道将它们直接放入查询数据库的脚本中并不是一个好主意。但是，有人说您应该将连接详细信息放在单独的 PHP 脚本中，并包含该脚本进行连接。
有没有更安全的地方来放置连接详细信息？
Where is the most secure place to put MySQL database connection details when connecting via a PHP script?
$connection = mysql_connect($hostname, $username, $password);
if (!$connection) {die('Could not connect: ' . mysql_error());}
mysql_select_db($database, $connection);
I know it's not a good idea to put them directly in the script that is querying the database. However, some say that you should put the connection details in a separate PHP script and include that script to connect.
Is there a more secure place to put the connection details?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
通常的做法是将它们放入一个单独的文件中，并将其放在 Web 根目录之外。有关详细信息，请参阅此答案。
The usual practice is to put them into a separate file, and put that outside the web root. See this answer for details.
您可能希望将其放在不在 webapp 层次结构中的目录中，以防止浏览器有机会访问它。
根据您的偏执程度，您可以编写一个位于防火墙后面的 Web 服务，并调用凭据，但这可能有点过头了。
如果我们了解您的架构，这将会有所帮助，是否只是 php 脚本进入数据库，那么第一个建议是最好的，例如，如果您有防火墙，那么您将有更多选择。
You may want to put it in a directory that is not in the webapp hierarchy, to prevent a browser from having any chance to access it.
Depending on your level of paranoia, you could write a webservice that is behind a firewall, and call for the credentials, but that may be overkill.
It would help if we understood your architecture, is it just php script goes to database, then the first suggestion would be best, if you have firewalls, for example, then you will have more options.
如果您的操作系统具有合理的安全功能，那么只要文件属于具有最小权限的组，那么位于何处并不重要。
If your OS has reasonable security features, it doesn't matter so much where, as long as the file belongs to a group with the minimum possible rights.