# Basic Security Question, MySql-\>PHP-\>XML-\>Flash **URL:** \ **Category:** programming\ **Created:** [April 1, 2006, 8:21pm UTC](https://forum.kirupa.com/t/basic-security-question-mysql-php-xml-flash/184090 "2006-04-01T20:21:17Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![YoungNastyMan](https://avatars.discourse-cdn.com/v4/letter/y/a6a055/32.png) [@YoungNastyMan](https://forum.kirupa.com/u/YoungNastyMan)\ **Post date:** [April 1, 2006, 8:21pm UTC](https://forum.kirupa.com/t/basic-security-question-mysql-php-xml-flash/184090/1 "2006-04-01T20:21:17Z")
Hello: I recently made a flash application that dynamically loads photos from an XML that is actually created from a PHP page which pulls its information from a MySql database. I think the following tutorial explains how this can be done (more or less): [http://www.kirupa.com/web/mysql\_xml\_php.htm](http://www.kirupa.com/web/mysql_xml_php.htm) Anyhow, my question: Is this very secure? I mean, the following code that requires my username and password kinda frightens me: ```php $host = "localhost"; $user = "root"; $pass = ""; $database = "test"; $linkID = mysql_connect($host, $user, $pass) or die("Could not connect to host."); ``` My host, from what I understand is really good and secure, but I’m not making it easy for hackers by using this code… am I? ---
**Author:** ![Templarian](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/templarian/32/7152_2.png) [@Templarian](https://forum.kirupa.com/u/Templarian)\ **Post date:** [April 2, 2006, 3:52am UTC](https://forum.kirupa.com/t/basic-security-question-mysql-php-xml-flash/184090/2 "2006-04-02T03:52:58Z")
Everyone uses that exact same script to connect to there DB with PHP. And it sounds like you have a good secure host you shouldn’t worry. The only way for them to get your .php file is though a lot of work and your little DB is not interest to them lol. ---
**Author:** ![Seb\_Hughes](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@Seb\_Hughes](https://forum.kirupa.com/u/Seb_Hughes)\ **Post date:** [April 2, 2006, 9:22am UTC](https://forum.kirupa.com/t/basic-security-question-mysql-php-xml-flash/184090/3 "2006-04-02T09:22:26Z")
PhP Is not open source. ---
**Author:** ![955](https://avatars.discourse-cdn.com/v4/letter/9/4bbf92/32.png) [@955](https://forum.kirupa.com/u/955)\ **Post date:** [April 2, 2006, 10:09am UTC](https://forum.kirupa.com/t/basic-security-question-mysql-php-xml-flash/184090/4 "2006-04-02T10:09:45Z")
> [@Seb Hughes](#): > > PhP Is not open source. PHP is. What I think you mean is that someone can’t view PHP code unless they have filesystem access. ---
**Author:** ![nrirureta](https://avatars.discourse-cdn.com/v4/letter/n/57b2e6/32.png) [@nrirureta](https://forum.kirupa.com/u/nrirureta)\ **Post date:** [April 2, 2006, 10:15am UTC](https://forum.kirupa.com/t/basic-security-question-mysql-php-xml-flash/184090/5 "2006-04-02T10:15:33Z")
thats how everyone connects to a database…giving username and password…:sure: ---
**Author:** ![nrirureta](https://avatars.discourse-cdn.com/v4/letter/n/57b2e6/32.png) [@nrirureta](https://forum.kirupa.com/u/nrirureta)\ **Post date:** [April 2, 2006, 10:16am UTC](https://forum.kirupa.com/t/basic-security-question-mysql-php-xml-flash/184090/6 "2006-04-02T10:16:53Z")
> [@Seb Hughes](#): > > PhP Is not open source. WTF? What do you mean??? Explain please… 🙂 ---
**Author:** ![Seb\_Hughes](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@Seb\_Hughes](https://forum.kirupa.com/u/Seb_Hughes)\ **Post date:** [April 2, 2006, 11:48am UTC](https://forum.kirupa.com/t/basic-security-question-mysql-php-xml-flash/184090/7 "2006-04-02T11:48:01Z")
[QUOTE=λ]PHP is. What I think you mean is that someone can’t view PHP code unless they have filesystem access.[/QUOTE] Yea. ^Why is everybody stealing my WTF explain what you mean ☹ ---
**Author:** ![nrirureta](https://avatars.discourse-cdn.com/v4/letter/n/57b2e6/32.png) [@nrirureta](https://forum.kirupa.com/u/nrirureta)\ **Post date:** [April 2, 2006, 12:02pm UTC](https://forum.kirupa.com/t/basic-security-question-mysql-php-xml-flash/184090/8 "2006-04-02T12:02:06Z")
> [@Seb Hughes](#): > > Yea. > > ^Why is everybody stealing my WTF explain what you mean ☹ Sorry man…didnt think you would mind…Thought it was most appropriate in this situation (-: ---
**Author:** ![Ankou](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/ankou/32/1351_2.png) [@Ankou](https://forum.kirupa.com/u/Ankou)\ **Post date:** [April 2, 2006, 7:22pm UTC](https://forum.kirupa.com/t/basic-security-question-mysql-php-xml-flash/184090/9 "2006-04-02T19:22:47Z")
PHP is open source as in the code for PHP is available to be viewed/changed/etc. by anyone who downloads it. Want the source code? Go here: [http://us2.php.net/downloads.php](http://us2.php.net/downloads.php) The PHP code you use to display your site is not considered open source unless you’re allowing people access to view it. In otherwords your php file with your username, host, password, etc. for your MySQL database connection isn’t something that someone can just look at and get. If it were that easy you’d have seen a ton of various methods to make sure getting that information was not possible. And you probably would see putting that info into a php file on the PHP website. 🙂 ---
**Author:** ![YoungNastyMan](https://avatars.discourse-cdn.com/v4/letter/y/a6a055/32.png) [@YoungNastyMan](https://forum.kirupa.com/u/YoungNastyMan)\ **Post date:** [April 3, 2006, 7:54pm UTC](https://forum.kirupa.com/t/basic-security-question-mysql-php-xml-flash/184090/10 "2006-04-03T19:54:42Z")
Thanks a ton everybody!! Man, everyone at Kirupa is very helpful. :thumb: By the way, you can check the website I’m making here: [http://www.davidcrockettscoins.com](http://www.davidcrockettscoins.com) PS. I’m especially proud of my picture viewer in the ‘News’ section. ---
**Author:** ![SlowRoasted](https://avatars.discourse-cdn.com/v4/letter/s/a698b9/32.png) [@SlowRoasted](https://forum.kirupa.com/u/SlowRoasted)\ **Post date:** [April 3, 2006, 8:30pm UTC](https://forum.kirupa.com/t/basic-security-question-mysql-php-xml-flash/184090/11 "2006-04-03T20:30:41Z")
just make sure you are using that connect file as an include in your scripts and that you are storing it outside of the public\_html directory. ---
**Author:** ![bwh2](https://avatars.discourse-cdn.com/v4/letter/b/8c91f0/32.png) [@bwh2](https://forum.kirupa.com/u/bwh2)\ **Post date:** [April 3, 2006, 8:35pm UTC](https://forum.kirupa.com/t/basic-security-question-mysql-php-xml-flash/184090/12 "2006-04-03T20:35:11Z")
> [@SlowRoasted](#): > > just make sure you are using that connect file as an include in your scripts and that you are storing it outside of the public\_html directory. so how do you include a file that’s not in the public\_html directory? ---
**Author:** ![SlowRoasted](https://avatars.discourse-cdn.com/v4/letter/s/a698b9/32.png) [@SlowRoasted](https://forum.kirupa.com/u/SlowRoasted)\ **Post date:** [April 3, 2006, 8:47pm UTC](https://forum.kirupa.com/t/basic-security-question-mysql-php-xml-flash/184090/13 "2006-04-03T20:47:03Z")
Just use require\_once("…/…/abovethepubhtmldirectory.php"); ---
**Author:** ![bwh2](https://avatars.discourse-cdn.com/v4/letter/b/8c91f0/32.png) [@bwh2](https://forum.kirupa.com/u/bwh2)\ **Post date:** [April 3, 2006, 8:54pm UTC](https://forum.kirupa.com/t/basic-security-question-mysql-php-xml-flash/184090/14 "2006-04-03T20:54:10Z")
word. i’ll have to try that.