mysql - php mysql_connect security -
if web server , database server on different hosts, possible hacker packet sniffing or use other method database username/password when use mysql_connect in php code?
yes mysql_connect() can sniffed. password "scrambled", not stop attacker. quires thrown on wire in plain text , authenticated session can hijacked if sniffing tcp sequence id's.
you must use full transport layer encryption possible using mysql_client_ssl flag if worried attack. if putting mysql connection on internet or otherwise untrusted network necessity. not necessary if connecting via localhost.
Comments
Post a Comment