Securing Username and Password

[rickarro]

I'm having a little trouble understanding the mysql_connect and putting the user, passwd, database in a file outside of the web root. Can someone explain this to me like i'm 2 :)

mysql_connect establishes the connection to the db, and the way I understand it is..I can put the username and password of this connection in a file in the PHP/Includes folder so it is not in my webroot, but what to name it and how to use it are a little confusing to me. Can someone help in newbie terms?

Thanks

[buddylee17]

Create a .php file with your connection information. Something like this:

//connect.php
<?php
$dbhost = 'localhost';
$dbuser = 'username';
$dbpass = 'password';
$conn = mysql_connect($dbhost, $dbuser, $dbpass) or die('Error connecting to mysql');
$dbname = 'dbname';
mysql_select_db($dbname);
?>

Now store it on the server above the root. When you are ready to connect to the db, include the file in your script. The server will read it the same as if it were in the script. This is also handy for headers and footers. Instead of modifying every page, you just change that one file.

<?php
require './connect.php'; //you could also use include './connect.php';
$sql="SELECT * FROM table";

[rickarro]

Thank you for the reply. I'm getting a "1045: Access denied for user 'ODBC'@'localhost' (using password: NO)" Is the connect.php file supposed to go in the PHP/includes folder, or just in my inetpub folder above the wwwroot?

Here is my partial script:

<?php 

include './connect.php';
$connection = mysql_connect($host,$user,$pass) or die 
(mysql_errno().": ".mysql_error()."<BR>");
mysql_select_db($dbname);
$lname=$_POST['lname'];
$fname=$_POST['fname'];
$dob=$_POST['dob'];
$query= "select * from voter where lname='$lname' AND fname='$fname' AND dob='$dob'";

[rickarro]

Ok, i got it working, i didn't remove the

$connection = mysql_connect($host,$user,$pass) or die 
(mysql_errno().": ".mysql_error()."<BR>");
mysql_select_db($dbname);

into the connect.php file as well. Once I moved it from the main script over to the connect.php file, it worked great. Thanks so much, i've been playing with this for days now and just could not figure it out. I'd read up on it but i guess it was so simple that no one could explain it to the detail I needed. Thanks again.