Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:12298 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 30399 invoked by uid 1010); 23 Aug 2004 13:22:11 -0000 Delivered-To: ezmlm-scan-internals@lists.php.net Delivered-To: ezmlm-internals@lists.php.net Received: (qmail 30353 invoked from network); 23 Aug 2004 13:22:10 -0000 Received: from unknown (HELO amber.vis-av.com) (66.92.75.243) by pb1.pair.com with SMTP; 23 Aug 2004 13:22:10 -0000 Received: (qmail 2823 invoked from network); 23 Aug 2004 13:22:10 -0000 Received: from unknown (HELO random.?none?) (192.168.1.9) by amber.internal with SMTP; 23 Aug 2004 13:22:10 -0000 Received: (nullmailer pid 859 invoked by uid 0); Mon, 23 Aug 2004 13:22:09 -0000 To: Adam Q Cc: internals@lists.php.net References: <0ADA645E-F4F3-11D8-AC67-0003939D6C78@westnet.com.au> Reply-To: Derrell.Lipman@UnwiredUniverse.com Date: Mon, 23 Aug 2004 09:22:09 -0400 In-Reply-To: <0ADA645E-F4F3-11D8-AC67-0003939D6C78@westnet.com.au> (Adam Q's message of "Mon, 23 Aug 2004 18:56:10 +0800") Message-ID: Lines: 26 User-Agent: Gnus/5.090006 (Oort Gnus v0.06) XEmacs/21.4 (Common Lisp, i386-debian-linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Subject: Re: [PHP-DEV] SQLite security From: Derrell.Lipman@UnwiredUniverse.com Adam Q writes: > I think encryption for SQLite is essential for PHP. Without it, it makes it > almost useless in a webscripting language. Suppose you wanted to create an > open source, easily portable, file based guestbook in PHP. I would never use > SQLLite under the current circumstances... Although I would love to. It > seems like the perfect solution. > > The database needs a password.... otherwise it is just too much of a > security risk. Others have commented on where the database should (or shouldn't) be located to avoid these problems. If the server environment is so inadequately maintained as to put database files in locations where they might be downloaded, then I would contend that it would not be a difficult job to manage to download the PHP or other data file which contains the username and/or password that would be used to access the database. If the database is encrypted, there must be authentication information available to the script that's going to access the database. That's just as insecure. If you really want an SQLite dataabase to be encrypted, the author of SQLite, D. Richard Hipp, has a non-free (one-time royalty, I believe) enhancement to add that feature. You can find his email address at the sqlite site, http://www.sqlite.org Derrell