Protecting SQL Server for Private Usage
Multi tool use
Protecting SQL Server for Private Usage
So I have an issue. I have a server, lets call it (testserver.net). Right now, to change the database, from my application, my app runs "testserver.netadd.php". The problem is anyone can run that and change things in my database. How do I make it that needs some sort of verification before running the code in add.php so no one can just have access to my server? (Like a password or something).
3 Answers
3
create a token : 1MBASFDFACAUYTUG^%(!@UUIASNSR*_-+LASQWFVSA4QWYUI12670
,save this token safely with in your application.
Whenever you want to call the add.php pass the token like :
testserver.net?token=1MBASFDFACAUYTUG^%(!@UUIASNSR*_-+LASQWFVSA4QWYUI12670
add.php
$secret = $_POST['secret']; //use post or get
if($secret != $mySavedSecret){
die('intruder!!')
}
That URL data should be properly encoded... at least the percent-sign will makes troubles if unencoded.
– Lars Stegelitz
Jul 2 at 6:46
@LarsStegelitz exactly
– Shan
Jul 2 at 7:17
Place you add.php file in separate folder and password protect it, or you may use Password protect a specific URL solution
add.php
Can I use this if I call the url from my app?
– Ron Arel
Jul 2 at 5:42
i'm not sure about that, but you may try to pass authentication data (username and password) via your app. Or you think of some more sophisticated solution to authenticate your app... try to search around
– Lixas
Jul 2 at 5:45
You need to perform Authentication followed by Authorization. In PHP there are many frameworks which support this.
pls check this for basic authentication
https://book.cakephp.org/2.0/en/tutorials-and-examples/blog-auth-example/auth.html
or you can use popular frameworks and follow their tutorials to perform this.
check this php micro framework Slim
By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.
Let your application access the add.php with some secret tokens(make it a long string). if the token is not present with the request, deny access to the script file.
– Shan
Jul 2 at 5:45