php - Please, do I need to protect password before entry into my server provider mysql -

-

i designing small social community site before came across "password hashing" when researching. hosted site on hosting site, so, don't know if it's job protect users' passwords or job secure databases. please if don't understand question, ask can explain it.

short answer: both.

it both job , job secure database. should plan 1 or both of failing @ this.

access control

your job in securing database starts can manage: credentials use, both , application making.

everything gives kind of "privileged access" should set require login, , should involve strong password (i recommend using random password generators and/or password manager). may include not limited to:

  • the database login, both , application
  • ftp
  • ssh (consider looking key based authentication this)
  • admin accounts on website you're building

the database should require password connected to, , password should strong (i recommend random password generator this). same goes logins have server itself, may include things ftp , ssh, , logins application (such admin account) you're building, other applications such php admin.

application security

your role application developer secure application contacts database. point of view of securing database, worried sql injection. mention familiar i'll skip basics.

strongly consider using parameterized queries or orm.

if rely on escaping parameters every time write query, need make 0 mistakes database secure. single mistake have serious consequences.

using parameterized queries or orm can take care of you, don't need worry it, , less have sql injection vulnerabilities result.

you need follow other best security practices when building application - example, remote code execution vulnerabilities result in database access if no sql injection vulnerabilities present.

planning breach anyway

given how common sql injection vulnerabilities are, it's best practice try mitigate consequences as possible. password hashing comes it.

a brief summary: objective make time consuming attacker determine passwords given data stored in database. best options things bcrypt , scrypt. want secure, scrutizined, , in particular: slow.

avoid fast things such md5 , sha family.

appendix: if manage database server

in shared hosting arrangement, host running database server you. if you're managing - example, if had download , install database server application - have work do.

you need keep software database - , in fact software on server, including operating system - date ensure have latest security patches.


Comments

Post a Comment

Popular posts from this blog

java - nested exception is org.hibernate.exception.SQLGrammarException: could not extract ResultSet Hibernate+SpringMVC -

-
i trying fetch records database , having above error this classs appropriate getters , setters public class user { private int id; private string username; private string password; private string email; i have create database , inserted data below configuration <bean id="datasource" class="org.apache.commons.dbcp2.basicdatasource" destroy-method="close"> <property name="driverclassname" value="com.mysql.jdbc.driver"/> <property name="url" value="jdbc:mysql://localhost:3306/usersdb"/> <property name="username" value="root"/> <property name="password" value=""/> </bean> this complete stacktrace severe: servlet.service() servlet [appservlet] in context path [/spring] threw exception [request processing failed; nested exception org.hibernate.exception.sqlgrammarexception: not ...
Read more

sql - Postgresql tables exists, but getting "relation does not exist" when querying -

-
Image
i have postgresql db number of tables. if query: select column_name information_schema.columns table_name="my_table"; i list of columns returned properly. however, when query: select * "my_table"; i error: (programmingerror) relation "my_table" not exist 'select *\n "my_table"\n' {} any thoughts on why can columns, can't query table? goal able query table. you have include schema if isnt public one select * <schema>."my_table" or can change default schema show search_path; set search_path my_schema; check table schema here select * information_schema.columns for example if table on default schema public both works ok select * parroquias_region select * public.parroquias_region but sectors need specify schema select * map_update.sectores_point
Read more

asp.net mvc - breakpoint on javascript in CSHTML? -

-
i have .cshtml file has javascript tag. within script tag have few lines of javascript. first line of javascript refers property in @viewbag. other javascript lines plain script without mvc related references. observation: can place breakpoints (visual studio 2015) on each of these javascript lines. however, breakpoints has white dot in center of breakpoint symbol (red circle) except line @viewbag reference (this particular line not have white dot in center). it seems breakpoint without white dot hit during run-time. question: can explain going on here? white dot mean? why plain red breakpoint line line hitting breakpoint? the visual studio debugger expecting debug actual server-side code within .cshtml file opposed client-side javascript within it. iirc, visual studio allow debug javascript code expected in internet explorer (and possibly edge), other browsers want use either third-party tool or developer tools (f12) within browser. an easy approach take advant...
Read more