XP_2600 Posted May 28, 2012 Share Posted May 28, 2012 I have a PHP web interface , connected to mysql db, is it possible for anyone visiting the web interface to grip the database itself? he can get a record for sure using the web page but i mean getting the whole database offline. Link to comment https://www.neowin.net/forum/topic/1080095-web-interface-and-database/ Share on other sites More sharing options...
0 -Alex- Posted May 28, 2012 Share Posted May 28, 2012 Hey, thanks for your post. I'm struggling to understand you perfectly though, could you maybe try to explain a little more? Thanks :) Link to comment https://www.neowin.net/forum/topic/1080095-web-interface-and-database/#findComment-594892219 Share on other sites More sharing options...
0 The_Decryptor Veteran Posted May 28, 2012 Veteran Share Posted May 28, 2012 It depends on how the code is written, how it interacts with MySQL, etc. Link to comment https://www.neowin.net/forum/topic/1080095-web-interface-and-database/#findComment-594892221 Share on other sites More sharing options...
0 +Nik Louch Subscriber² Posted May 28, 2012 Subscriber² Share Posted May 28, 2012 I swear the quality of replies on here is headed downhill. Anyway... If you have a well written front-end, using a good connection object (I favour PDO), disallowing SELECT statements and work purely with stored procedures, then that's a major start. You should connect using a user with just enough permissions, sure as hell not ROOT or such. Then on your database allow connections only via specified users and known IPs. That's a major start Link to comment https://www.neowin.net/forum/topic/1080095-web-interface-and-database/#findComment-594892649 Share on other sites More sharing options...
0 -Alex- Posted May 28, 2012 Share Posted May 28, 2012 On 28/05/2012 at 12:00, nik louch said: I swear the quality of replies on here is headed downhill. Elaborate? Link to comment https://www.neowin.net/forum/topic/1080095-web-interface-and-database/#findComment-594893603 Share on other sites More sharing options...
Question
XP_2600
I have a PHP web interface , connected to mysql db, is it possible for anyone visiting the web interface to grip the database itself? he can get a record for sure using the web page but i mean getting the whole database offline.
Link to comment
https://www.neowin.net/forum/topic/1080095-web-interface-and-database/Share on other sites
4 answers to this question
Recommended Posts