At 01:50 PM 2/20/2001 -0600, you wrote:
>As far as I know, you can not download PHP programs without access to
>download them. Meaning you need an account on the webserver, so they would
>need your account user and pass before they could steal your mysql user and
>pass.
The main issue is that (especially under Unix), the Front Page server
extensions are notoriously poorly written and in most cases leave massive
security holes wide open. Try doing a Google search for "hacking
frontpage" to see some examples. The real solutions are:
do not host with a provider that supports Front Page
do not use Front Page as your HTML editor
If you do decide to use Front Page as your editor make sure that you do not
let it (or immediately remove them) the "shadow" directories of _vti_cnf
(there are others too which I forget) that it likes to include with
uploads. As long as you avoid that pitfall and the server does not have
the server extensions installed you should be safe.
You should also place your sensitive values in a separate file that is
located in a non-web accessible directory or if you are running under "safe
mode", in a protected sub-directory. Under Apache you would just have to
create a directory called something like "./include" and in it place a
.htaccess file with the following line:
deny from all
This makes it so that the only way to access the file is via an include
command within PHP. This won't save you from local users viewing the file
but that is a different sack of nuts.
Cheers
-----------------------------------------------------------------------------
Island Net AMT Solutions Group Inc. Telephone: 250 383-0096
1412 Quadra Toll Free: 1 800 331-3055
Victoria, B.C. Fax: 250 383-6698
V8W 2L1 E-Mail: [EMAIL PROTECTED]
Canada WWW: http://www.islandnet.com/
-----------------------------------------------------------------------------
--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]
