php mysql_connect安全性

Question

如果Web服务器和数据库服务器位于不同的主机上，那么当您在PHP代码中使用mysql_connect时，黑客是否可以进行数据包嗅探或使用其他方法获取数据库用户名/密码？

Answer 1

Yes mysql_connect() can be sniffed. The password is "scrambled" , but this will not stop an attacker. All quires are thrown over the wire in plain text and the authenticated session can be hijacked if you are sniffing TCP sequence id's.

You must use full transport layer encryption which is possible using the MYSQL_CLIENT_SSL flag if you are worried about this attack. If you are putting a mysql connection over the internet or otherwise untrusted network then this is a necessity. This is not necessary if you are connecting via localhost.

Answer 2

I think that a hacker can sniff the packets if he has some kind of access to the web server or db server, or at least to the LAN where one of these servers are and in this case you have bigger problems. But if the web server is on webhost.com, the db is on dbhost.com and the hacker tries to sniff from outside then he cannot do much.