How can I make my PHP forms secure (when they post to a MySQL database)?

  • Thread starter Thread starter daring_to_speak
  • Start date Start date
D

daring_to_speak

Guest
I'm coding a php form which connects to a MySQL database, using the following code:

HTML Code (excerpt):
<FORM ACTION="formsubmit.php" METHOD="POST" NAME="contact_form">
...

PHP Code (excerpt from "formsubmit.php"):
<?php
$con = mysql_connect((database_name).mysql.myserver.com, username,password);
...

What I'd like to know is how can I stop people being able to open up my PHP file (which can be easily found out from the HTML source code above) and then obtain the username and password of my SQL database! This seems like a big security issue which I would like to resolve.

I'm new to MySQL and PHP so apologies if I seem somewhat clueless :D
 
Put all your connection parameters and sensitive stuff in a php file, and call (require_once/include) the file on your script. Make the connection file unreadable by external IPs on the server
 
Back
Top