[PHP] Hard coding in an Admin Account

[ROSEBLOOD]

Is it safer to hard code an Admin account into the page, or should I just add it into the MySQL DB? I'm just looking at what will be more secure. ~ROSEBLOOD

 

[David Lindon]

Could you be a little more specific? Are you talking about embedding a password into a PHP page or the DB?

 

[rot13]

I think you would be better off adding it into the DB. If somebody reverse-engineers your page somehow then your admin details are freely available to them plus you can change it in the DB without having to change the source code in your page. Its better to use the db for both security and convenience issues.

 

[J03]

I think you would be better off adding it into the DB. If somebody reverse-engineers your page somehow then your admin details are freely available to them plus you can change it in the DB without having to change the source code in your page. Its better to use the db for both security and convenience issues.

Maybe, but if someone "reverse engineered" you'r page, which was logging into a mySQL DB, then they would have the username and password to login to the database, which contained the Admin Password or w/e.. (but i do agree with you, a DB would be better)

 

[ROSEBLOOD]

I have the Admin account in the PHP code. I was thinking about it and figured that embedding it into the code would be more secure since i couldn't think of an easy way to extract the name and password.

I'll add it to the DB. Thanks guys

~ROSEBLOOD

 

[joxley1990]

How could they not extract it, all you need to do it view the page source and all the information would be there.. ?

 

[J03]

Not if it's PHP. PHP is Server side, so you cant view the source code. All you would get would be HTML.

 

[root]

either way is just as secure

if you put it in the php source code, it's not displayed to the user, (unless there is an error and it displays source code).

if you have the admin account in a DB you still have to have the db password in the php, so the password is still just as exposed to any 'hacker' who would have got the password by reading your source code anyway, because by the time they've seen the source, they seen all the code and know the DB passwords and how to get the passwords from the DB

storing the password in the DB is a lot more convenient.

 

[DJ Stephen]

I agree with root, however there are the points below:

If you hard code it into the script, this is only ideal for 1 - 5 users and won't be updated hardly every and it's slightly easier, however the database method would be from 5+ members and is alot easier to update, however will take a little more code to do things like:

$name = mysql_real_escape_string($_POST['name']);

Hope this helps..

 

[AllThingsSacred]

Using the database makes it more maintainable, but root is right in the two ways being equally secure.