Security of PHP data

[Jalz]

Hey y'all,

 

I've a got a relativey simple database working online with API for PHP. I have a connection file, which creates the FileMaker object, fairly basic stuff - but the problem is the username and password are embbeded in this file.

 

I would like to query the database from another server, I can use cURL to post on the username and password from the other server to the FM Server, but its not very secure.

 

Does anyone have any pointers how I can achieve passing credentials from another machine to the FileMaker server without compromising security. I'm trying to use FileMakers API for PHP without the use of plugins if possible. I was considering SOAP but not sure thats the right route to go as its not native, I have to start using plugins. Wish FileMaker had this integrated in their standard software.

 

Thanks as always  

[webko]

What's the issue with having the password in the connection file? No one without access directly to the server at OS level can see the contents of that file...

 

I've got an example - tell me what the user name and password to my database is, knowing the information is held in the file:

 

http://webko.id.au/include/db_config_test.php

[Jalz]

Hi Webko,

 

I can't, thanks for proving the point. Makes me a little more confident of what I'm doing.

[dansmith65]

If your web server is not the same computer as your FileMaker server, you should consider using SSL on that connection.

 

Also, make sure to use appropriate file permissions on the configuration file. If your web server is a shared server, for example, make sure no other users have read access to that file.