mysql_connect password encryption

[zeronexxx]

Hi All

I am a bit concerned about storing my MySQL password as plain-text in PHP source code while calling php_connect().

Are there any measure or workaround where I can put encrypted password while connecting to my database?

Any help will be much appreciated.

Thanks & regards

Zeronexxx

[Cheap Scotch Ron]

You can encrypt the credentials...
http://dev.mysql.com/doc/refman/5.1/...functions.html
http://www.webmasterworld.com/forum88/4590.htm

That said, you should also secure both the mysql and php environments...
http://www.securityfocus.com/infocus/1726
http://www.securityfocus.com/infocus/1706

[niggles]

The one thing the (quite old) article at WebmasterWorld doesn't say is always sanitise the user input or your database will be open to SQL Injection i.e

$userName = mysql_real_escape_string($_POST["username"]);

etc... rather than just passing the raw $_POST data to your query.

Cheers,
Niggles