PROBLEM:

• When a PHP application makes a database connection it of course generally needs to pass a login and password.
• If you are using a single, minimum-permission login for my application, then the PHP needs to know that login and password somewhere.
• What is the best way to secure that password? It seems like just writing it in the PHP code isn’t a good idea.

SOLUTION 1:

• The usual solution is to move the password out of source-code into a configuration file.
• Then leave administration and securing that configuration file up to your system administrators.
• That way developers do not need to know anything about the production passwords, and there is no record of the password in your source-control.

SOLUTION 2:

• If you’re hosting on someone else’s server and don’t have access outside your webroot,
• you can always put your password and/or database connection in a file and then lock the file using a .htaccess:

<files mypasswdfile>
order allow,deny
deny from all
</files>

SOLUTION 3:

• The most secure way is to not have the information specified in your PHP code at all.
• If you’re using Apache that means to set the connection details in your httpd.conf or virtual hosts file. If you do that you can call mysql_connect() with no parameters, which means PHP will never ever output your information.
• This is how you specify these values in those files:

php_value mysql.default.user      myusername
php_value mysql.default.password  mypassword
php_value mysql.default.host      server

• Then you open your mysql connection like this:

<?php
$db = mysqli_connect();

Or like this:

<?php
$db = mysqli_connect(ini_get("mysql.default.user"),
                     ini_get("mysql.default.password"),
                     ini_get("mysql.default.host"));

SOLUTION 4:

This solution is general, in that it is useful for both open and closed source applications.

• Create an OS user for your application.
• Create a (non-session) OS environment variable for that user, with the password.
• Run the application as that user

Advantages:

1. You won’t check your passwords into source control by accident, because you can’t
2. You won’t accidentally screw up file permissions. Well, you might, but it won’t affect this.
3. Can only be read by root or that user. Root can read all your files and encryption keys anyways.
4. If you use encryption, how are you storing the key securely?
5. Works x-platform
6. Be sure to not pass the envvar to untrusted child processes

This method is suggested by Heroku, who are very successful.

SOLUTION 5:

• If it is possible to create the database connection in the same file where the credentials are stored.
• Inline the credentials in the connect statement.

                                       mysql_connect("localhost", "me", "mypass");

• Otherwise it is best to unset the credentials after the connect statement, because credentials that are not in memory, can’t be read from memory

include("/outside-webroot/db_settings.php");  
mysql_connect("localhost", $db_user, $db_pass);  
unset ($db_user, $db_pass); 

SOLUTION 6:

• Best way is to not store the password at all!
• For instance, if you’re on a Windows system, and connecting to SQL Server,you can use Integrated Authentication to connect to the database without a password, using the current process’s identity.
• If you do need to connect with a password, first encrypt it, using strong encryption (e.g. using AES-256, and then protect the encryption key, or using asymmetric encryption and have the OS protect the cert), and then store it in a configuration file (outside of the web directory) with strong ACLs.

SOLUTION 7:

We have solved it in this way:

1. Use memcache on server, with open connection from other password server.
2. Save to memcache the password (or even all the password.php file encrypted) plus the decrypt key.
3. The web site, calls the memcache key holding the password file passphrase and decrypt in memory all the passwords.
4. The password server send a new encrypted password file every 5 minutes.
5. If you using encrypted password.php on your project, you put an audit, that check if this file was touched externally – or viewed. When this happens, you automatically can clean the memory, as well as close the server for access.

SOLUTION 8:

• An additional trick is to use a PHP separate configuration file that looks like that :

<?php exit() ?>

[...]

Plain text data including password

• This does not prevent you from setting access rules properly.
• But in the case your web site is hacked, a “require” or an “include” will just exit the script at the first line so it’s even harder to get the data.
• Nevertheless, do not ever let configuration files in a directory that can be accessed through the web.
• You should have a “Web” folder containing your controler code, css, pictures and js. That’s all. Anything else goes in offline folders.