Is there a way to hide my password for database access in my config.php configuration file ?
What is the best way to do this ?
I want to hide to visitors and hosting's admin :)
+3
A:
It depends on what you are going to use the password for, a possible method would be to store a hash of your password rather than the password itself. When you then want to check if the password being used to login is correct, you just have to hash the password used to login and compare it to the stored hashed value.
However as edwin said that isn't possible if you are storing passwords for external services like databases. (In which case I would direct you towards Foxtrot's answer).
Yacoby
2010-05-14 16:18:25
But that's of no use if you need a password to connect to a database, for example.
edwin
2010-05-14 16:19:39
+9
A:
You can't generally hide them, per se, because they have to at some point in run-time be read by the application using it. the better bet is to keep them secure so they don't have a chance to be readable by anyone by you (or authorized personnel)
For example, your config.php should NOT be in a public or html directory that's web accessible. if I go to website.com/config.php -- I should not see the file produced (even if it would typically be blank) This is because sometimes PHP code is exposed when a configuration setting is off, and this could reveal the code that sets the password you're trying to keep private.
Foxtrot
2010-05-14 16:19:36
+4
A:
password for database access. I want to hide to visitors and hosting's admin
You can't hide anything in a file from the hosting admin. Even if you use encryption, they can still find the key in your PHP source. If you don't trust your admin, get off the box.
webbiedave
2010-05-14 17:35:56
+1
A:
You can hide the password from your sites visitors (see the other answers on that) but probably not from the servers administrators. They also probably have root access to any of your databases so they wouldn't even need the password.
The only way to really hide your sensitive data on a remote server is to rent a dedicated machine that you have root access to, store all data on that machine and use an encrypted file system.
Techpriester
2010-05-14 23:28:56