MySQL.php Security Question.

[bloodless2010]

Hey there.

I have a question about the MySQL.php file,

Isn't it possible someone can include the file from your website (In this case the mysql.php) and then use it to connect to your database?

Is it possible to stop this?

I.e hotlink protection maybe?

Thanks.

[SHAD]

From the top of my head,maybe you could have some-sort of identification- code which will need to be verified before the file is allowed to be executed?

[bloodless2010]

Yeah, I was thinking of that, but I don't want to edit ALL of my files, I don't fancy that ATM,

Is it possible to check the URL that it's running at and die / continue from there,

i.e if the URL is my domain then it can run, else die.

[lucky3809]

Relocate it out of the public root then set and change the permission to the file. You will also need to change any page that includes that file, by adding the correct path to it.

Edited December 8, 2012 by lucky3809

[KyleMassacre]

What about using define()

[rockwood]

MySql is totally unsafe so use mysqli or PDO