3

I've seen some website on security recommend to enable mysql.safe_mode in php.ini

# Enable SQL safe mode
sql.safe_mode = On

When I searched hard to find info on this, I found this:

If the SQL Safe Mode option is enabled the MySQL and Ingres extensions will ignore the supplied host, user and password information and will use only the default ones.

By the sound of that, it really sounds like an unsafe mode than safe mode. Doesnt it mean, even if the application (say Joomla) supplies a mysql user with lesser previleges, enabling this will make mysql use the default root user for it? Have I misunderstood what it does? What is the benefit of enabling sql.safe_mode in php?

  • 1
    MySQL sets the default so if you only allow localhost to connect to a database regardless what is in php.ini the database can only be connected to with a local ip. – Simon Hayter Oct 31 '14 at 20:11
  • so what effect it could have to Joomla or wordpress installations if this is enabled? Is it safer to have it on? – Neel Oct 31 '14 at 20:25
  • If I am going to be connecting to database only as localhost from Joomla, I understand setting this to enable shouldnt have any effect isint it.. – Neel Oct 31 '14 at 20:28
  • The default user doesn't have to be a highly-privileged one like root. If you use safe mode, you should set the default to a low-privilege user. Then if a script tries to use root, it will not be allowed. – Barmar Nov 4 '14 at 22:36
  • So if I create a separate user and don't use the default root one to connect from cms applications, then setting mysql.safe_mode to on will not work since it may only use the default root one and not the new less privileged user supplied, is that right? – Neel Nov 5 '14 at 11:00
5

To use safe_mode, set your database host, username and password in php.ini using the configuration parameters:

sql.safe_mode = On
mysqli.default_host = "127.0.0.1"
mysqli.default_port = "3306"
mysqli.default_user = "root"
mysqli.default_pw = "Password123"

By having it configured there you will not need it in your PHP scripts - enabling you to update your MySQL password from one place while also making your source code safe from including a password so that you don't have to keep manually removing the password prior to committing to source code version control repositories etc.

In your PHP scripts then instead of using:

<?php
$oDB = new mysqli( "127.0.0.1", "root", "Pass123", "database_name", "3306" );

You might use:

<?php
$oDB = new mysqli();
$oDB->select_db( "database_name" );
  • That's the first answer that made perfect sense. Thank you for answering with an example. – Neel Nov 19 '14 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.