如何保护我的 mysql_connect 密码（我的数据库服务器的密码）？
*此问题适用于非本地主机。 *我正在使用网络托管服务。不是我的个人服务器。
要使用 mysql_connect 连接到数据库服务器，需要创建一个 php 文件并将其保存在 Web 主机的服务器中。该文件必须（在代码中）包含服务器地址、用户名和密码：
**$conn = mysql_connect("server", "username", PASSWORD);**
任何查看页面代码并下载此 php 文件的人都可以看到密码，这是一个安全风险。
如何保护我的数据库服务器密码？
*This question is for NON-local host's.
*I am using a web-host service. NOT my personal server.
To use mysql_connect, to connect to a database's server, one needs to create a php file and save it in the web host's server. This file must have (within the code) the server's address a user name and PASSWORD:
**$conn = mysql_connect("server", "username", PASSWORD);**
Anyone who view's the page's code and downloads this php file can see the password, which is a security risk.
HOW CAN I SAFEGUARD MY DATABASE' SERVER' PASSWORD?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您确实没有任何好的选择来保护数据库密码。您应该确保用户/密码组合只能访问使您的 Web 应用程序运行所需的数据库部分。换句话说，不要将其设为 root 密码。如果您有 Web 应用程序未使用的其他数据库，它们应该具有不同的登录凭据。
除非Web服务器配置错误，否则任何人都不可能下载PHP文件来查看代码。如果可能的话，您还应该将包含登录凭据的文件放置在 Web 服务器的文档根目录之外并
include()它，以减少该文件被错误配置的 Web 服务器意外暴露的可能性。这是信任托管公司的系统管理员的问题。
如果您四处搜索，您可能会发现尝试将加密凭据存储在另一台服务器上并在运行时通过加密连接检索它们的示例，但解密信息的密钥仍然需要保存在 Web 服务器上，因此可以访问系统管理员。
如果您的网络托管服务商将您的文件提供给其他客户/客户，而不是将它们分区到仅供您使用的位置，那么您应该立即寻找新的托管服务商。
You really don't have any good options for protecting the database password. You should make sure that the user/password combination only have access to the parts of your database necessary to make your web application run. In other words, don't make it the root password. If you have other databases not used by the web application, they should have different login credentials.
Unless the web server is misconfigured, it is not possible for anyone to download the PHP file to view the code. You should also, if possible, place the file containing the login credentials outside the web server's document root and
include()it, lessening the chance that it could be accidentally exposed by a misconfigured web server.This is a question of trusting the system administrators of your hosting company.
If you search around, you may find examples of attempts to store the encrypted credentials on another server and retrieve them at runtime via an encrypted connection, but still the keys to decrypt the information need to be held on the web server and are therefore accessible to the system administrators.
If your web host makes your files available to other clients/customers rather than partitioning them where they're only available to you, you should find a new host immediately.