I've seen some website on security recommend to enable mysql.safe_mode in php.ini

# Enable SQL safe mode
sql.safe_mode = On

When I searched hard to find info on this, I found this:

If the SQL Safe Mode option is enabled the MySQL and Ingres extensions will ignore the supplied host, user and password information and will use only the default ones.

By the sound of that, it really sounds like an unsafe mode than safe mode. Doesnt it mean, even if the application (say Joomla) supplies a mysql user with lesser previleges, enabling this will make mysql use the default root user for it? Have I misunderstood what it does? What is the benefit of enabling sql.safe_mode in php?

  • 1
    MySQL sets the default so if you only allow localhost to connect to a database regardless what is in php.ini the database can only be connected to with a local ip. Commented Oct 31, 2014 at 20:11
  • so what effect it could have to Joomla or wordpress installations if this is enabled? Is it safer to have it on?
    – Neel
    Commented Oct 31, 2014 at 20:25
  • If I am going to be connecting to database only as localhost from Joomla, I understand setting this to enable shouldnt have any effect isint it..
    – Neel
    Commented Oct 31, 2014 at 20:28
  • The default user doesn't have to be a highly-privileged one like root. If you use safe mode, you should set the default to a low-privilege user. Then if a script tries to use root, it will not be allowed.
    – Barmar
    Commented Nov 4, 2014 at 22:36
  • So if I create a separate user and don't use the default root one to connect from cms applications, then setting mysql.safe_mode to on will not work since it may only use the default root one and not the new less privileged user supplied, is that right?
    – Neel
    Commented Nov 5, 2014 at 11:00

1 Answer 1


To use safe_mode, set your database host, username and password in php.ini using the configuration parameters:

sql.safe_mode = On
mysqli.default_host = ""
mysqli.default_port = "3306"
mysqli.default_user = "root"
mysqli.default_pw = "Password123"

By having it configured there you will not need it in your PHP scripts - enabling you to update your MySQL password from one place while also making your source code safe from including a password so that you don't have to keep manually removing the password prior to committing to source code version control repositories etc.

In your PHP scripts then instead of using:

$oDB = new mysqli( "", "root", "Pass123", "database_name", "3306" );

You might use:

$oDB = new mysqli();
$oDB->select_db( "database_name" );
  • That's the first answer that made perfect sense. Thank you for answering with an example.
    – Neel
    Commented Nov 19, 2014 at 16:17
  • and is it good to set root access?
    – luky
    Commented Aug 23, 2020 at 17:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.