I have read a little bit about that, but I can't find answer that is telling me exactly what to do.  So here's what I have been doing to store my database password in php:  Lets say that my website is in the folder website. So we have  /website/mysite.php   My password is store outside this folder, in (for exemple)  /mypassword/mypassword.php and I get it with an include '../mypassword/....';  On this file, the permissions are at 600, so owner can read and edit the file.   Is it the proper way of doing it? or is there another way, more secure? (And easy to use too!) Sorry for my poor english, I'm not a native english speaker.
27997
When a PHP application makes a database connection it of course generally needs to pass a login and password. If I'm using a single, minimum-permission login for my application, then the PHP needs to know that login and password somewhere. What is the best way to secure that password? It seems like just writing it in the PHP code isn't a good idea.
87049
I'm not sure how password hashing works (will be implementing it later), but need to create database schema now.  I'm thinking of limiting passwords to 4-20 characters, but as I understand after encrypting hash string will be of different length.  So, how to store these passwords in the database?
29250
Is there any simple (IE: right click in Nautilus) way to password protect a particular folder/file in Ubuntu? I've got a few files containing sensitive info and I'd much prefer that if/when I leave my computer alone, they aren't accidentally accessed by someone else.  The secruty does not have to be extremely tight. My only concern is that when family/friends come over, I don't really like the idea of them looking at my bank details, accounts or, you guessed it, porn collection.  A simple, effective way to let me put my machine in the hands of someone else knowing that said machine can not cause me embarresment is the sole reason why I'd like to see this in Ubuntu.
106111
I have already uploaded some files in the free web host I chose and created a database there using phpMyAdmin v2.11.4  Also, I have Googled first this question before posting this here but I don't understand some rules and I need a clarification.  The exact error I get from viewing my uploaded file(index.php) is this:  Warning: mysqli_connect() [function.mysqli-connect]: (HY000/1130): Host '31.170.160.98' is not allowed to connect to this MySQL server in /home/a6400350/public_html/subdomains/index.php on line 7   Domain name of free web host I'm using is   And my php code for connecting to host is:  &lt;?php  $host = "sql10.000webhost.com"; //or "31.170.160.98" $username = "a6400350xxxxxx"; $password = "••••••••";  $con = mysqli_connect($host, $username, $password);  ?&gt;    I also check if the server is down  or it's just me There was also no previlege section in phpMyAdmin page as other suggest   Don't I have any permission to connect programmatically to this host as I am just a free user?  Edit     I'm also thinking of uploading the whole XAMPP in the server so I   could do the things I'm imagining.   Edit 2     Also one more thing, I imported the database by means of .sql file   locally through that server, maybe this has something to do about it?
6700
A sample /etc/group file contains the following entries:  root:*:0: adm:!:4:logcheck antoine:x:1000:   The man pages I've read (Debian &amp; OSX) says the second field is to store a group password.  As they are rarely used, an asterisk * or a x is usually placed in it rather than leaving it blank.  The shadow man page also says that this second field should store the result of the crypt function.  And if an invalid result is stored (such as * or !) it means the password cannot be used as authentication method.  Does that hold true for the group file as well?  Why do I end up with 3 different characters in my group file all having the same meaning?  Can I safely change all to *?
101940
I just installed appache, MySQL and PHP, suring my installation, I was prompted for a MySQL root user password, but when I start my MySQL, it pops the error, and I just can't seem to find a way around it, most solutions I've read doesn't solve it, moreover, I found out that the /var/run/mysqld path doesn't even exist, my php also needs the socket to connect to my Database.
53727
I'm building a small web app in PHP that stores some information in a plain text file. However, this text file is used/modified by all users of my app at some given point in time and possible at the same time.  So the questions is. What would be the best way to make sure that only one user can make changes to the file at any given point in time?
67742
I am writing a script to add a large amount of users to a system. Part of this involves setting default passwords for each user. How can I set users' passwords without it prompting me for the password up front?  Unfortunately passwd doesn't seem to take an argument stating the new password to set. I'm using Ubuntu 11.10.
73
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
91200
I want to store client side encrypted data in Drupal 7, so that it is encrypted on the client end, and stored and transmitted in encrypted form. The password is never transmitted or stored on the server. The only modules I have found which do this are  and  but they are for Drupal 6. I need something that is user specific, so that different users can use different keys, rather than a single key or a set of keys used on the server end. Are there any similar modules for Drupal 7?
103035
I remember seeing a way to have an &lt;input type="password" /&gt; such that the browser will not prompt the user to save the password. But I'm drawing a blank. Is there an HTML attribute or some JavaScript trick that will do this?
37547
Session variables are apparently not working for me. I don't know what I'm doing wrong. This is the code that I'm using to check for a valid password:  if ($input_password_hash == $password_hash)  {   session_start();   $_SESSION['is_user'] = 1;   header("Location: ../new_look"); //or Location: index.php  } else echo "Wrong password.";   in the index.php file (where it redirects to), I have this code:  if ($_SESSION['is_user'] == 1) {   //show index page with navigation bar for registered user }  else {  //do something else }   but it's not working at all.  The session does apparently start and that can be verified by checking the cookie.  What am I doing wrong?
39236
is there a possibility to use a (mysql) Database to manage SSH login credentials instead of /etc/passwd ?  I know I could use ldap but I only want simple user management and ldap seems a little bit overpowered for this job.
33135
I'm suffering from a spam hack where my site periodically starts to show Viagra spam to Google and other spiders. The method of the hack is basically that my .htaccess file gets modified to route all requests through a file called "common.php", which is a big chunk of base64 encoded evilness.  I've noticed it happening on a weekly basis: every time I remove the hacked files, it pops back up a few days later. These are the steps I've already taken to secure things:   Changed my FTP password Scanned my (shared hosting) directories for world-writable (777) files/folders and changed them to 755 or something more appropriate Removed old copies of Wordpress from unused directories (the site itself is a custom-written PHP CodeIgniter app) Downloaded the entire site to my local box and scanned the directories for occurences of strings like "base64" and ".ru" (spam domains?).   I'm a little uncertain what to do next as the problem still seems to be there. Is there some smart shell command I can run to figure out how these files are being uploaded? When I last checked, the .htaccess file was edited today by my own FTP user despite me changing the password a week ago and logging out any logged-in users. I don't leave it logged in on public machines, and a few other administrators of the site haven't been given the new password yet.  Any tips / ideas gratefully received. I'm happy to provide the output of any specific commands as needed.  Matt
81600
We know that users' passwords are saved in /etc/passwd, but in an encrypted way, so even the root can't see them:  jane:x:501:501::/home/jane:/bin/bash fred:x:502:502::/home/fred:/bin/bash   As shown above, :x: represents the password.  Is there a way (possible configuration) to save the password in the /etc/passwd in clear text and such that the root can see them?
96046
I am having a few issues when people are trying to access a MySQL database and they are trying to update tables with the same information.  I have a webpage written using PHP. In this webpage is a query to check if certain data has been entered into the database. If the data hasn't, then i proceed to insert it. The trouble is that if two people try at the same time, the check might say the data has not been entered yet but when the insert takes place it has been by the other person.  What is the best way to handle this scenario? Can i lock the database to only process my queries first then anothers?
116538
I am running a website but for some days i stopped it and put the under-construction page because the Index of admin page is visible to the outside world through the Google search. One of my friend told me that your websites index is visible and its one step away to access the password file and he shows me that very simply using the Google search.  How can i prevent this and i am hosting my site with a hosting company and i report about this to them but they simply replied to me still its secure so you no need to worry...  am i really don need to worry and continue my site with the visible index of admin page?