security and hacking of mysql-servers

Question

i'm very very new in questions such hacking, security, servers. Where i can read some documentation about security, and hacking of php(mysql) servers.

Maybe you will give some links, where can learn about such things?

Thanks

Answer 1

I follow this :

MySQL : SecureInstallation - Tips&Tricks

Answer 2

SQL databases are very often left vulnerable by the applications that use them. For example, your PHP app that's connecting to the database should be very careful with user input that reaches the database. Spend some time learning about "SQL injection" - it's one of the most common and dangerous attacks, and unless you are aware of it, you might end up building a web app that's vulnerable.

Connect to your database using least privilege. Avoid connecting as the database owner, for example. This is an example of "defense in depth". Say you have a SQL injection vulnerability, but your database only allows your public facing web app to run SELECT statements. An attacker who exploits your SQL injection vulnerability will be able to read data, but not update or delete data. Obviously it'd be best not to have the vulnerability in the first place, but in case one slips through, you have that second line of defense - you've connected to the database using a limited amount of privilege.

"Never connect to the database as a superuser or as the database owner. Use always customized users with very limited privileges"

This is an excerpt from an article I think you should read: http://phpbuilder.com/manual/en/security.database.sql-injection.php

HTH