Member Avatar for ryantroop

Hi All!

So, I have a shared windows host with IIS 7 with godaddy, so that I can use MSSQL/TSQL (which, as I understand it, is not available with Linux).

However, my server configuration education was with Linux, and focused on the wonderful all encompassing .htaccess file to configure environment variables, webroot, includes default folder, etc...

Is there is a simple way to do this with godaddy's set up? If not, what are my alternatives to protect passwords from web access, and preventing other very simple security vulnerabilities with IIS? How can I set environment variables that are free from prying eyes that I Can store password salt and other sensitive info that is meant to be private?

Am I just using IIS incorrectly in how I set this up? Or is the beliefe that php is secure enough that it doesn't need a webroot that is held in another file?

Any suggestions?

Thanks,

Ryan

  • 2 Contributors
  • 7 Replies
  • 285 Views
  • 3 Hours Discussion Span
  • Latest Post Latest Post by stormal1

Dani AI

Generated

A few practical notes to clear up the IIS vs Apache thinking raised by and to expand on ’s useful points.

IIS doesn’t use .htaccess — the equivalent is web.config plus IIS request-filtering/handler rules. IIS hides common config files (web.config, App_Code, etc.) by default and provides requestFiltering so the server won’t serve those files as static downloads. That makes storing certain secrets in a web.config less obviously dangerous than putting a plain text file in the webroot, but it’s not a reason to be lax. (learn.microsoft.com)

Recommended options (ranked):

  • Put the credentials file outside the public webroot (best).
  • If that isn’t possible, block direct HTTP access to that file with web.config request-filtering or a location rule so the server never returns it. Example: deny common include/ini extensions at the site level so files like config.inc or secrets.ini can’t be fetched. Encrypt ASP.NET connectionStrings when available (protected configuration / aspnet_regiis) for an extra layer — note DPAPI is machine-specific so coordinate keys with the host. (learn.microsoft.com)

If PHP is used under IIS, FastCGI in IIS can accept environment variables (so a host-level secret can be passed into PHP rather than stored in a file). Many shared providers lock those server sections, so ask the host whether they expose app-settings / env-vars or let you edit FastCGI settings. If they don’t, fall back to the encrypted config / file-outside-webroot approach. (learn.microsoft.com)

Password storage: don’t roll your own salt scheme. Use PHP’s built-in helpers and modern KDFs. Current best practice is to use a memory-hard algorithm (Argon2id) where available; PHP’s password_hash()/password_verify() are the right primitives and automatically manage salts. Consider adding a secret “pepper” stored outside the DB (env-var or key vault) for extra defense. (cheatsheetseries.owasp.org)

Short checklist: confirm web.config protections by requesting the file in a browser, prefer files outside webroot, use password_hash()/password_verify() (Argon2id if available), and ask GoDaddy whether they provide encrypted app settings or let you set FastCGI env-vars before moving to a VPS for full control.

Recommended Answers

All 7 Replies

Member Avatar for stormal1

You really should direct your query to GoDaddy support staff as you are not configuring a local IIS server and must utilize their own online configuration tools. Server Side code via PHP, ASP.net or similar can be used for secure access however secure .hta access is not possible on IIS. Both PHP and ASP can be securely utilized with MSSQL.

Member Avatar for ryantroop

I did call them, and they weren't terribly helpful.

I was hoping for a more clear answer than the "help" they gave which was a link to domain forwarding, which didn't help with environ globals.

Am I being paranoid in that I want my db password/etc.. stored separately from the web root?

Member Avatar for stormal1

MSSQL db passwords are not stored in the webroot. They are stored in the SQL server itself. If your code has been implemented properly no one can access your stored db connection credentials.
You can also create a secured local ODBC connection to a remote server and utilize Microsoft's MSSQL remote administration/management console if you so desire.

Edited by stormal1 because: typo
Member Avatar for ryantroop

so a connection to the DB with PHP on a windows server is integrated? So I Can just access the db/table without any user/pass being passed through the mysqli api?

Member Avatar for stormal1

The credentials are transmitted from IIS/PHP to MSSQL via TCP.

My own website is one such example -http://www.site-smith.com/

Edited by stormal1 because: typo
Member Avatar for ryantroop

Ahh.. so it was a fundamental misunderstanding of how the connection process works.

Thanks for clearing that up.. That makes things easy.

Now for figuring out how to salt passwords with a hidden variable.. or just time to learn a new method for password hashing... have any advice on that?

Member Avatar for stormal1

You'll find this helpful

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.