How can I encrypt or hide passwords in a Perl script used to connect to mysql database

Question

I was wondering what is the best way to store usernames and password to connect to mysql database?

Answer 1

An easy and safe way — if you do it right — is with a config file. The DBI/DBD MySQL connection string will look something like–

dbi:mysql:my_dbname;mysql_read_default_file=/NON-WEB/path/to/.my.cnf

–and you will pass no user or password to the DBI connection call.

The .my.cnf file will have the password. The ways to keep this safe include–

• File is only readable by the webuser.
• File is outside the web root; visiting a URL cannot possibly reach it.
• The config file contains the bare minimum to connect, it probably does not need the user name for example.
• Make sure there are no exploits in your application that might allow browsing of your file system.
• The webuser's mysql account has limited privileges: no grant, no create|drop tables, etc, etc.