Re: [PHP] is it safe to store username and password for mysql connection in session variables?

From: Chris Shiflett (shiflett_at_php.net)
Date: 11/24/03 

Date: Mon, 24 Nov 2003 08:03:58 -0800 (PST)
To: anders thoresson <listor@thoresson.net>, php-general@lists.php.net

--- anders thoresson <listor@thoresson.net> wrote:
> In the ini-files for my php-projects, I store various settings.
> Two of them is username and password for my mysql-connections.
>
> Is it safe to load these two into session variables when a user logs
> in to my application?

For the most part, yes, it is fine. Because session variables are
maintained on the server, many risks are not a concern.

However, there are some things to consider. Where is session data stored?
If you are using the default location /tmp and are on a shared server,
session data is pretty easy to access by others who share your server.
Depending on how the server and PHP is configured, they may be able to
browse your home directory as well, so you might be out of luck. :-)

Some have suggested setting such things in the VirtualHost directive of
Apache, thereby creating environment variables. This might be easier to
hide from others on the server.

If it's a dedicated server, there is much less to worry about.

> What I don't understand, and hence the questions, is wether session
> variables are accessible by my website's visitors, or just to the
> php-scripts on the server.

Session variables, barring a compromise of your server, are only available
to users as you make them available. So, as long as your code never
outputs the value you wish to keep hidden, you'll be fine.

Hope that helps.

Chris

=====
Chris Shiflett - http://shiflett.org/

PHP Security Handbook
     Coming mid-2004
HTTP Developer's Handbook
     http://httphandbook.org/
RAMP Training Courses
     http://www.nyphp.org/ramp

Relevant Pages

  • Re: Using ASP.NET StateServer on another machine. So what?
    ... You will never get a perfromance increase when moving from InProc to State ... When you use InProc the session variables can be lost when the process ... You do not need 2nd box just for State Server.) ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Advice on mod_lisp-based web application.
    ... problems vanish then I'm definitely interested in trying to change ... recommendation is to migrate those to "session variables". ... uses a submit button to send the next bit of data back to the server. ... guarantee of number or order of client requests and therefore, ...
    (comp.lang.lisp)
  • Re: asp session help
    ... then re-direct to the buildrows.asp page. ... values and I can set the session variables. ... >> Hi Ray, ... The user must submit the form before your server can get the ...
    (microsoft.public.inetserver.asp.general)
  • Re: QueryString Hiding
    ... you could use Session variables when values are kept in memory for user's ... at the server without client browser intervention. ... "Shock" wrote in message ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Server 2003
    ... So if the user logs onto another computer and tries to access the ... problem workstation can access one of the other workstation's printers. ... I even used the change network id wizard to create a new ... but the server files are still not fully accesible. ...
    (microsoft.public.windows.server.general)