Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #4790 > unrolled thread

Local vs. hosted connection

Back to article view | Back to comp.lang.php

Contents

  Local vs. hosted connection Aulë <aule.vala@gmail.com> - 2012-02-11 12:17 -0500
    Re: Local vs. hosted connection Jerry Stuckle <jstucklex@attglobal.net> - 2012-02-11 14:46 -0500
      Re: Local vs. hosted connection Aulë <aule.vala@gmail.com> - 2012-02-12 10:50 -0500
        Re: Local vs. hosted connection Jerry Stuckle <jstucklex@attglobal.net> - 2012-02-12 11:13 -0500
          Re: Local vs. hosted connection bill <nobody@spamcop.net> - 2012-02-13 07:56 -0500
            Re: Local vs. hosted connection Jerry Stuckle <jstucklex@attglobal.net> - 2012-02-13 08:26 -0500

#4790 — Local vs. hosted connection

Greetings, fine denizens.  I've made significant progress in my project 
since my first post here some time ago, and I have a question related to 
a chunk of code I developed to simplify connection to my database. 
Locally, I need one set of parameters, but after uploading the pages to 
my web host, I need a different set of connection parameters. 
Initially, I simply edited the file after uploading it, but that got 
tiresome quickly, so I came up with the following, which sends the 
correct parameters based on the SERVER_NAME value:

<?php

// Define application constants.
define('HOSTED', ($_SERVER['SERVER_NAME']=='localhost') ? false : true);

// Open the database.
$db = open_db(HOSTED);
if ($db) {
   // Do stuff
}

function open_db($hosted = false) {

   // Define connection values.
   if ($hosted) {
     $host = (string) [[mywebhost.com]];
     $user = (string) [[mywebhost_username]];
     $pass = (string) [[mywebhost_password]];
     $data = (string) [[mywebhost_mysql_database]];
     $port = (int) [[mywebhost_port]];
   } else {
     $host = "localhost";
     $user = (string) [[localhost_usename]];
     $pass = (string) [[localhost_password]];
     $data = (string) [[localhost_mysql_database]];
     $port = (int) [[localhost_port]];
   }

   // Execute connection string.
   $db = mysqli_connect($host, $user, $pass, $data, $port);

   // Stop script if connection fails.
   if (mysqli_connect_errno()) {
     printf("Connection failed: %s\n", mysqli_connect_error());
     exit();
   } else {
     return($db);
   }

}
?>

The cast double brackets are simply placeholders I put here in this post 
to indicated where I have coded my actual parameters in the indicated 
type.  (I left "localhost" as it is.)

My question is this: is all this secure on the Web, or is there a way 
for someone to remotely acquire such stored connection parameters?

[toc] | [next] | [standalone]

#4792

On 2/11/2012 12:17 PM, Aulë wrote:
> Greetings, fine denizens. I've made significant progress in my project
> since my first post here some time ago, and I have a question related to
> a chunk of code I developed to simplify connection to my database.
> Locally, I need one set of parameters, but after uploading the pages to
> my web host, I need a different set of connection parameters. Initially,
> I simply edited the file after uploading it, but that got tiresome
> quickly, so I came up with the following, which sends the correct
> parameters based on the SERVER_NAME value:
>
> <?php
>
> // Define application constants.
> define('HOSTED', ($_SERVER['SERVER_NAME']=='localhost') ? false : true);
>
> // Open the database.
> $db = open_db(HOSTED);
> if ($db) {
> // Do stuff
> }
>
> function open_db($hosted = false) {
>
> // Define connection values.
> if ($hosted) {
> $host = (string) [[mywebhost.com]];
> $user = (string) [[mywebhost_username]];
> $pass = (string) [[mywebhost_password]];
> $data = (string) [[mywebhost_mysql_database]];
> $port = (int) [[mywebhost_port]];
> } else {
> $host = "localhost";
> $user = (string) [[localhost_usename]];
> $pass = (string) [[localhost_password]];
> $data = (string) [[localhost_mysql_database]];
> $port = (int) [[localhost_port]];
> }
>
> // Execute connection string.
> $db = mysqli_connect($host, $user, $pass, $data, $port);
>
> // Stop script if connection fails.
> if (mysqli_connect_errno()) {
> printf("Connection failed: %s\n", mysqli_connect_error());
> exit();
> } else {
> return($db);
> }
>
> }
> ?>
>
> The cast double brackets are simply placeholders I put here in this post
> to indicated where I have coded my actual parameters in the indicated
> type. (I left "localhost" as it is.)
>
> My question is this: is all this secure on the Web, or is there a way
> for someone to remotely acquire such stored connection parameters?

If it's outside the DOCUMENT_ROOT so no one can download it, it's 
secure.  Otherwise a server misconfiguration can expose you errors.

Why not just include a configuration file on both systems, each with the 
appropriate settings?  Much cleaner and less error prone.

BTW - unless you are the domain owner for mywebhost.com, you should not 
be using their name.  Instead, use example.com, example.org, etc., which 
have been specifically reserved for such uses.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#4793

On 2/11/2012 2:46 PM, Jerry Stuckle wrote:
>
> If it's outside the DOCUMENT_ROOT so no one can download it, it's
> secure. Otherwise a server misconfiguration can expose you errors.

Nice.  Okay.

> Why not just include a configuration file on both systems, each with the
> appropriate settings? Much cleaner and less error prone.

Are you referring to a PHP.INI?  If so, I wasn't aware that I could do 
so on the host.  That would definitely simplify some things.

> BTW - unless you are the domain owner for mywebhost.com, you should not
> be using their name. Instead, use example.com, example.org, etc., which
> have been specifically reserved for such uses.

I have no explanation for {not} thinking "mywebhost" wouldn't be an 
actual site.  That is excellent information about "example" domains.

TYVM.

[toc] | [prev] | [next] | [standalone]

#4794

On 2/12/2012 10:50 AM, Aulë wrote:
> On 2/11/2012 2:46 PM, Jerry Stuckle wrote:
>>
>> If it's outside the DOCUMENT_ROOT so no one can download it, it's
>> secure. Otherwise a server misconfiguration can expose you errors.
>
> Nice. Okay.
>
>> Why not just include a configuration file on both systems, each with the
>> appropriate settings? Much cleaner and less error prone.
>
> Are you referring to a PHP.INI? If so, I wasn't aware that I could do so
> on the host. That would definitely simplify some things.
>

No, I'm referring to your own configuration file.  Your file; include it 
where you need the information in it.  Call it conf.php or whatever; it 
keeps server-specific information in it.

>> BTW - unless you are the domain owner for mywebhost.com, you should not
>> be using their name. Instead, use example.com, example.org, etc., which
>> have been specifically reserved for such uses.
>
> I have no explanation for {not} thinking "mywebhost" wouldn't be an
> actual site. That is excellent information about "example" domains.
>
> TYVM.


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#4798

On 2/12/2012 11:13 AM, Jerry Stuckle wrote:
> On 2/12/2012 10:50 AM, Aulë wrote:
>> On 2/11/2012 2:46 PM, Jerry Stuckle wrote:
>>>
>>> If it's outside the DOCUMENT_ROOT so no one can download it, it's
>>> secure. Otherwise a server misconfiguration can expose you
>>> errors.
>>
>> Nice. Okay.
>>
>>> Why not just include a configuration file on both systems,
>>> each with the
>>> appropriate settings? Much cleaner and less error prone.
>>
>> Are you referring to a PHP.INI? If so, I wasn't aware that I
>> could do so
>> on the host. That would definitely simplify some things.
>>
>
> No, I'm referring to your own configuration file. Your file;
> include it where you need the information in it. Call it conf.php
> or whatever; it keeps server-specific information in it.

example:
<?
error_reporting(E_ALL); // of course you put this in for testing
require ("myconf.php");  // different on the server and for testing


>
>>> BTW - unless you are the domain owner for mywebhost.com, you
>>> should not
>>> be using their name. Instead, use example.com, example.org,
>>> etc., which
>>> have been specifically reserved for such uses.
>>
>> I have no explanation for {not} thinking "mywebhost" wouldn't
>> be an
>> actual site. That is excellent information about "example"
>> domains.
>>
>> TYVM.
>
>

[toc] | [prev] | [next] | [standalone]

#4799

On 2/13/2012 7:56 AM, bill wrote:
> On 2/12/2012 11:13 AM, Jerry Stuckle wrote:
>> On 2/12/2012 10:50 AM, Aulë wrote:
>>> On 2/11/2012 2:46 PM, Jerry Stuckle wrote:
>>>>
>>>> If it's outside the DOCUMENT_ROOT so no one can download it, it's
>>>> secure. Otherwise a server misconfiguration can expose you
>>>> errors.
>>>
>>> Nice. Okay.
>>>
>>>> Why not just include a configuration file on both systems,
>>>> each with the
>>>> appropriate settings? Much cleaner and less error prone.
>>>
>>> Are you referring to a PHP.INI? If so, I wasn't aware that I
>>> could do so
>>> on the host. That would definitely simplify some things.
>>>
>>
>> No, I'm referring to your own configuration file. Your file;
>> include it where you need the information in it. Call it conf.php
>> or whatever; it keeps server-specific information in it.
>
> example:
> <?
> error_reporting(E_ALL); // of course you put this in for testing

No, this is in the php.ini file, not the code.  Of course it will be 
different in your development and production systems, but should never 
be set in a production system (at least not for very long).

The only time I enabled error_reporting on a production system was to 
troubleshoot what ended up being a server configuration problem.

> require ("myconf.php"); // different on the server and for testing
>
>
>>
>>>> BTW - unless you are the domain owner for mywebhost.com, you
>>>> should not
>>>> be using their name. Instead, use example.com, example.org,
>>>> etc., which
>>>> have been specifically reserved for such uses.
>>>
>>> I have no explanation for {not} thinking "mywebhost" wouldn't
>>> be an
>>> actual site. That is excellent information about "example"
>>> domains.
>>>
>>> TYVM.
>>
>>
>


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.php

csiph-web