隐藏“connect.php”密码最受接受的方法是什么？文件？
随着我的服务器变得越来越大，越来越多的用户可以访问它，我不希望他们看到 MySQL 用于连接 PHP 的密码，该密码存储在我的“connect.php”文件中并且是必需的每一页。然而，它只是与其余 php 文件位于同一目录中。
我考虑过使用第二个类似“connect.php”的文件，该文件只能访问一个表，该文件存储连接到 MySQL 的加密密码，但这样我就会遇到隐藏密钥的问题。
更改权限也不起作用，如果您 chmod 或 或类似的操作，显然没有人能够访问该 Web 应用程序。
是否有公认的方法来解决这个问题，或者我应该自己解决它？问题是，如果有一种可接受的方法，我不希望它太复杂。
As my server is getting a bit bigger, and more users are getting access to it, I don't want them to see the password that MySQL is using to connect to PHP, which is stored in my 'connect.php' file and required by every page. However, it is just sitting in the same directory as the rest of the php files.
I've considered using a second 'connect.php'-like file with access to only one table, that stores the encrypted passwords to connect to MySQL, but then I would have the problem of hiding the key to it.
Changing permissions won't work either, if you chmod o-r or something similar, nobody will be able to access the web application, obviously.
Is there an accepted method to get around this problem, or should I just solve it on my own? The problem is that I don't want it to be too convoluted if there is an accepted method.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
我强烈建议将
connect.php移至DOCUMENT_ROOT上方的一个目录中，以便您的网络服务器无法访问它。您的 php 文件当然可以包含带有完整或相对路径的
connect.php例如：I would strongly recommend moving
connect.phpin one directory above yourDOCUMENT_ROOTso that it is not accessible from your web server.Your php files can of course include
connect.phpwith full or relative path eg:所有答案都有很好的建议，但未能解决这样一个事实：任何具有服务器访问权限的用户都可以在编辑器中窥探并打开 config.php。
将您的配置文件设置在公共网络空间之外的目录中，网络服务器应该是该目录的所有者，并且它的权限应该设置为 700。它包含的所有文件都应该是 644。这样就没有人可以甚至除了网络服务器用户或 root 之外，还可以读取文件内容。
这是一种常见的方法，但该主题还有很多内容，因为安全性是一个非常广泛的主题，但比 90% 的设置都要好。
All the answers have good advice but fail to address the fact that any user with server access can just snoop around and open the config.php in an editor.
Set your config files in a directory outside of public webspace , the webserver should be the owner of this directory and it should have permissions set to 700. All files it contains should be 644. This way no one can even read the file contents apart from webserver user or root.
This is a common approach, but there is a lot more to the subject as security is a very vast topic, but is better than 90% of the setups out there.
设置
$password，连接，然后unset()$password。他们应该永远无法恢复它。我不认为 PHP 文件可以下载，也没有见过。它总是由服务器之前编译的。
Set
$password, connect, thenunset()$password. They should be never able to recover it.I don't think a PHP file can be downloaded anyway, neither seen. It is always compiled by the server before.
服务器端文件的内容无法被用户获取，除非您自愿（或错误地）向他们显示。
最有可能的是，任何妥协都会通过 FTP 访问来实现，在这种情况下，黑客无论如何都可以访问网络服务器上的所有文件。
The content of server side files cannot be obtained by users, unless you show it to them willingly (or by mistake).
Most likely any compromise would come via FTP access in which case a hacker would have access to all files on the webserver anyway.
将其移动到 www 根目录之后的文件夹，例如 www/includes。
从那里，您可以使用 htaccess 阻止查看 /includes 下文件的权限。
连接到SQL数据库后，使用unset($username, $password)，这样就不会出现有人回显用户名或密码的安全威胁。
最后，最好拥有专用托管，以便其他有权访问 Web 服务器的人无法查看其他用户的文件。
Move it to a folder after the root of www, such as www/includes.
From there, you may use htaccess to block permission for viewing files under /includes.
After connected to the SQL database, use unset($username, $password) so that there is no security threat of someone echoing the username of password.
Finally, it's always best to have dedicated hosting so that nobody else with access to the web server can potentially view other user's files.
或者，您可以完全摆脱密码并将数据库服务器配置为仅接受来自本地主机的连接。不过，这仅适用于专用托管，如果您使用共享托管，则会存在安全风险。
Alternatively, you could get rid of passwords altogether and configure the DB server that only connections from localhost are accepted. This'll only work on dedicated hosting though, it's a security risk if you're on shared hosting.