PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

Database Server Security
383
n
Look for services that offer trial periods, money-back guarantees, or some other
way of seeing firsthand how your web applications will run before committing to
using them for a longer period of time.
Database Server Security
In addition to keeping all of our software up-to-date, we can do a few things to keep
our databases more secure as well. Again, although a complete treatment of security
would require a full book for each of the database servers against which we might write
our web applications, we will give some general strategies here to which we should all
pay attention.
Users and the Permissions System
Spend the time to get to know the authentication and permissions system of the database
server that you have chosen to use. A surprising number of database attacks succeed
simply because people have not taken the time to make sure this system is secure.
Make sure that all accounts have passwords. One of the first things you do with any
database server is make sure that the database super user (root) has a password. Ensure
that these passwords do not contain words that are from the dictionary. Even passwords
such as 44horseA are much less secure than passwords like FI93!!xl2@. For those worried
about the ease with which passwords can be memorized, consider using the first letter of
all the words in a particular sentence, with some pattern of capitalization, such as
IwTbOtIwTwOt, from “It was the best of times, it was the worst of times” (A Tale of Two
Cities, by Charles Dickens).
Many databases (including older versions of MySQL) will be installed with an anonymous
user with more privileges than you would probably like.While investigating and
becoming comfortable with the permissions system, make sure that any default accounts
do exactly what you want them to do, and remove those that do not.
Make sure that only the super-user account has access to the permissions tables and
administrative databases. Other accounts should have only permissions to access or modify
strictly those databases or tables they need.
To test it out, try the following, and verify that an error occurs:
n Connect without specifying a username and password.
n Connect as root without specifying a password.
n Give an incorrect password for root.
n Connect as a user and try to access a table for which the user should not have permission.
n Connect as a user and try to access system databases or permissions tables.