Security risks of php based mysql queries

I am just getting started with dynamic website programming and was reading up methods of querying a mysql database. The php query routine requires the connection to be established with the user name and password. Since this php query is present in the internet folder and is world readable surely this is very high risk? Is there something I am missing or are there methods of linking the query from the public directory to a non public directory that will obviate this.

edit: I have just read this thread;

http://www.linuxquestions.org/questi...hreadid=310768

and this is exactly what I am talking about. Someone has obtained the mysql access details from the script and penetrated the database. What is to stop anyone using the same type of agent off the net penetrating the database in the same way.

I am going to answer my own question. If I am wrong could someone correct me.
The answer seems to lie in defining a user on the database and further defining the rights of the user on the database.
Reference article. .

Quoting from this article; the user can be defined as having read rights only and only to this database;

mysql> GRANT SELECT ON database_name.* TO utahep@localhost IDENTIFIED BY ‘utahep’;

This means that you created a user ‘utahep’ who can connect with a password ‘utahep’ from the localhost having only read privileges (means selective privileges) on the database which is ‘database_name’.

See my reply to the thread in your first post ...

But yes, you should exercise due diligence when setting up your database users too.

Seems your other thread has been removed, not that I'm surprised due to the war going on there. Anyway, as suggested in that thread, you can use file permissions to control which local users can access the sensitive file also. If I understood you correctly. You stated that you had to allow the file to be world readable so that the Apache webserver could access the file, and as a consequence to doing that you are also allowing every local user (ie users whom have shell access to the server) to also access the file. Which is how your database was compromised. Correct? If so, then there is a way to prevent the users from accessing the file while still allowing the webserver to access it, using file permissions. To do so, you'll just need to know what group Apache runs as. To explain further, consider this file:

----------  1 bob users 5 Apr 10 01:11 test.txt

Here test.txt has 000 for it's permissions. Nobody, not even bob can read it. Of course since bob owns it, he can change the permissions, delete it, or whatever. But that's beside the point.

-rw-------  1 bob users 5 Apr 10 01:11 test.txt

Here test.txt has 600 for it's permissions. Now bob can read/write to it, but nobody else can.

Now, suppose Apache runs as group "nogroup" and I want to allow Apache to access it without allowing everyone else to. I just change the group to "nogroup".

-rw-r-----  1 bob nogroup 5 Apr 10 01:11 test.txt

Here test.txt has 640 permissions and belongs to the group "nogroup". Since Apache runs under that group, Apache can now access the file, as can bob. But no other local users can because they neither belong to the group "nogroup" nor are they bob. At least the other users "shouldn't" belong to that group. Now there is a catch. As a non-root user whom also doesn't belong to the group "nogroup" you can not change the file to that group. hehe... Kind of a catch 22. Anyway, you should be able to get whoever has root access on the server to change it for you, I'd think. Especially considering you've already been compromised.

Also don't take the above the wrong way. I merely set out to explain the process and not to question your skill level.

Something else you may want to look into, in addition to the read-only control user for the database, is http authentication. That is if you need your users to have a higher level of control over the database vs just read access. Personally, I've never implemented it from scratch, but I do know that it's possible. And example program that can be setup to use it is phpMyAdmin. It can also be setup to use cookies. With http authentication you'd be prompted for a username/password by Apache when you logged onto the website (or loaded the php page, whatever the case might be) and then that username and password is used to connect to the server instead of the one in your php file. The only downside is the extra hassle your users would have to go through to get logged in. And if you could put the website behind SSL, even better. Anyway, you could probably sift through phpMyAdmin's source and figure out how they do it and implement that on your server. Good luck.

DaHammer I have done quite a bit of reading of various basic php/mysql documents available on the net and the php part of any html page is not readable from outside. This was the part I could not get to grips with. The general recommendations in these documents also strongly advise setting up specific users for given databases and not to have root capability. Thanks for your thoughts and input.

Don't forget:

chown -R <userid>:<apache's group> /path/to/your/DocumentRoot
find /path/to/your/DocumentRoot -type f | xargs chmod 640
find /path/to/your/DocumentRoot -type d | xargs chmod 750