> The browser has no direct connection to MySQL, so you are correct -- > "those privilege tables are not helping to check on the privileges if > the client is from browser". >
I find this a bit misleading. The privilege tables still work exactly as they are intended. That is, they check for a valid username and password pair and then check to see if the request is coming from an authorized ip address. Because the web server is on localhost it is determined to be an authorized ip address and the privileges in the grant table are granted. If, on the other hand, someone tried to connect to mysql remotely from a mysql client, their ip address would be checked, just as the web server's ip address is checked. If the ip address is listed in the grant tables, privileges are given. If the ip address is not in the grant table then access is denied. It seems to me that you are concerned about who may or may not access your web pages that happen to access mysql. If that is the case, then you are concerned with your web server's authentication scheme and not mysql's authentication. For instance, if I have phpmyadmin running on my web server, I will need to use the web server's authentication scheme to verify by username, password and ip address whether or not the remote user should have access to phpmyadmin. phpmyadmin, on the other hand, already has access to mysql because I put the correct username and password in the config file and it exists on localhost where I have granted privileges. Fred -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
