I would like to know what exactly I am password protecting on my server when I set a database password. I am unclear as to what people are referring to when saying to password protect a database. Are they referring to a single specific database or do they mean the complete mysql database structure located on the server. The reason I ask is because, when I set a password, it is only one password for all my databases that I'm managing in phpMyAdmin. So when I'm required to enter the password in my config file in codeigniter, it is always the same one for all my different databases that I'm using. Is the password that I'm required to enter in order to even get phpMyAdmin started the Database Password which people refer to, or can I (and should I) set different passwords for my seperate Databases?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
The passwords you're talking about are passwords for MySQL users. You don't really set a password for a database or table. You can effectively implement different passwords for different DBs by creating multiple users with different passwords and only granting access to specific databases for each user. When people say that you should set a password for the database, they probably mean that you shouldn't use users with no password, which is possible, but shouldn't be done due to the obvious security concerns.
Whether or not you "should" use multiple users depends on your situation. If you have multiple databases that are used by independent applications, it is a good idea to create a user for each application to help isolate any risks from spreading between applications via the database. If you have one database that is used by different applications, you can use different users to help track stuff or lock down permissions. If you have on application, you're generally safe with using just one user.
The main reason to use different users is to lock down permissions and prevent any errors/attacks from causing too much damage. If you're performing a task that only needs to read data, using a user that only has
This is just some supplemental information from G-Nuget's answer since I'm still unable to post comments.
The passwords are for database users. The users have a set of permissions(SELECT, INSERT, EXEC...), Roles(Root,DBA,...) and access to tables/views/databases which can also be configured to be on able to be accessible only from a specific ip address/range. For example, you can restrict root to only be accessible from localhost, meaning that any remote device trying to remotely login to your db server as root will be denied.
Also, you should always use multiple users on your database/tables in order to lock down permissions even if you only have one database being accessed by one application. Since you're using phpmyAdmin, its safe to assume that you are creating a website or web application. Database and web apps mean that you allow input and output from forms for most cases, in the case of form inputs, you are susceptible to SQL Injection attacks which could possibly pull out a drop table from what should be just a simple and harmless select or insert query. Of course, proper code sanitation can also prevent this, but its still better safe than sorry.
Even if you are only on a dev environment, still practice using multiple users to lock down database and table permissions in order to keep it as a best practice and reduce the effort of moving from a single user database to a multi-user locked down database. Doing so will add some complexity to the program, but its better than having your data stolen, or worse, destroyed.