PHP MySQL - Stilson.net

www.it-ebooks.infoCHAPTER 30 • USING PHP WITH MYSQLOf course, MySQL’s canned error messages can be a bit ugly to display to the end user, so you mightconsider sending the error message to your e-mail address, and instead displaying a somewhat moreuser-friendly message in such instances.■ Tip MySQL’s error messages are available in 20 languages and are stored in MYSQL-INSTALL-DIR/share/mysql/LANGUAGE/.Storing Connection Information in a Separate FileIn the spirit of secure programming practice, it’s often a good idea to change passwords on a regularbasis. Yet, because a connection to a MySQL server must be made within every script requiring access toa given database, it’s possible that connection calls may be strewn throughout a large number of files,making such changes difficult. The easy solution to such a dilemma should not come as a surprise—store this information in a separate file and then include that file in your script as necessary. Forexample, the mysqli constructor might be stored in a header file named mysql.connect.php, like so:This file can then be included as necessary, like so:Securing Your Connection InformationIf you’re new to using a database in conjunction with PHP, it might be rather disconcerting to learn thatinformation as important as MySQL connection parameters, including the password, is stored in plaintext within a file. Although this is the case, there are a few steps you can take to ensure that unwantedguests are not able to obtain this important data:• Use system-based user permissions to ensure that only the user owning the webserver daemon process is capable of reading the file. On Unix-based systems, thismeans changing the file ownership to that of the user running the web processand setting the connection file permissions to 400 (only the owner possesses readaccess).• If you’re connecting to a remote MySQL server, keep in mind that this informationwill be passed in plain text unless appropriate steps are taken to encrypt that dataduring transit. Your best bet is to use Secure Sockets Layer (SSL) encryption.593