PHP 初学者尝试使用 Salt 加密
我正在尝试编写一个 PHP 登录脚本，并注意到以纯文本形式存储数据库密码并不安全。我的 connect.php 文件安全吗？如何在下面的 connect.php 文件中使用盐加密？
感谢并抱歉提出一个基本问题，我对 PHP 还很陌生。
<?php
if(!defined('INCLUDE_CHECK')) die('You are not allowed to execute this file directly');
/* Database config */
$db_host = 'localhost';
$db_user = 'randomuser';
$db_pass = '123456';
$db_database = 'randomdatabase';
/* End config */
$link = mysql_connect($db_host,$db_user,$db_pass) or die('Unable to establish a DB connection');
mysql_select_db($db_database,$link);
mysql_query("SET names UTF8");
?>
I'm trying to put together a PHP login script and have noticed that storing my database paswords in plain text form is not secure. Is my connect.php file secure? How would I use a salt encryption into my connect.php file below?
Thanks and sorry for a basic question, I am still very new to PHP.
<?php
if(!defined('INCLUDE_CHECK')) die('You are not allowed to execute this file directly');
/* Database config */
$db_host = 'localhost';
$db_user = 'randomuser';
$db_pass = '123456';
$db_database = 'randomdatabase';
/* End config */
$link = mysql_connect($db_host,$db_user,$db_pass) or die('Unable to establish a DB connection');
mysql_select_db($db_database,$link);
mysql_query("SET names UTF8");
?>
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
在某种程度上 - 是的。
您不能在 connect.php 中使用任何“盐加密”。保持原样即可。
To some extent - yes.
You can't use whatever "salt encryption" with your connect.php. Just leave it as is.
首先，我建议学习一些有关加密、散列和加盐的文章，以大致了解它的作用和不作用。
维基百科并不了解全部内容，但那里的文章涵盖了最相关的部分。
php 脚本的密码是通常不加密。最佳实践是将其存储在单独的配置文件（pe config.php）中，这样由您的系统管理员来保护它，这不仅有助于您的安全，而且这样的外部配置文件也可以做到这一点。更容易移植应用程序。大多数主要的 php 应用程序，从论坛引擎、CMS、日历等等，都使用这种架构。
First I recommend studying a few articles about encryption, hashing and salting, to get a general feel on what it does and what it doesn't do.
Wikipedia doesn't know it all, but the articles are there cover the most relevant parts.
Passwords for php scripts are usually not encrypted. Best practise is to store it in a separate configuration file (p.e. config.php). This way its up to your system administrators to secure this. This doesn't only help your security, such an external configuration file makes it easier to port an application. Most major php applications, from forum engines, CMS, calendars or whatever, use this kind of architecture.
这是安全的。
这取决于您的托管提供商及其设置。
对于安全项目，我建议至少使用 VDS。
It's secure.
It depends on your hosting provider and it's setting.
For secure projects I recommend using at least VDS.
也许是一个额外的答案。是的，据我所知，除了以明文形式存储数据库连接凭据之外，没有其他方法可以存储它。
也许您可以使用加密方案加密您的凭据，但如果攻击者有权访问您的文件（和您的加密方案），他们可以轻松解密您的加密凭据。
只要您保证其安全，您的
connect.php就是安全的。一些建议：connect.php放在网络服务器的根目录之外（您仍然可以从任何其他脚本包含它）以防止来自 HTTP 的访问php，不要重命名该文件将由网络服务器作为可查看文本文件提供的任何其他扩展名.htaccess规则保护您的connect.phpMaybe an additional answer. Yes, as far as I know, there's no other way to store database connection credentials than storing it in plaintext.
Maybe you can encrypt your credentials using an encryption scheme, but if the attacker have access to your files (and your encryption scheme), they can decrypt your encrypted credentials easily.
Your
connect.phpis secure as long as you keep it secured. Some suggestions:connect.phpoutside webserver's root directory (you still can include it from any other script) to prevent access from HTTPphp, don't rename the file to any other extension that will served by the webserver as a viewable text fileconnect.phpwith some.htaccessrules您可能想使用 ioncube 加密您的 connect.php... http://www.ioncube.com/ ...为了它仍然可以保护的东西。
我喜欢在我的 .htaccess 中添加这样的内容：
You may want to encrypt your connect.php with ioncube... http://www.ioncube.com/ ...for what it can still protect.
I like to add stuff like this in my .htaccess :