So I was trying to figure out how to write an automated backup script for php on a shared webhost to execute using mysqldump, with no root access to core php.ini or mysql config on the remote database server, no decent access above "true" web root (just .htaccess mods) and no automated backup protection other than command line.

Apparently it's possible to run mysqldump with passwords hidden in a defaults file, but only in a specifically named my.cnf with an odd --defaults-group-suffix syntax which only works for mysql (not mysqlnd), and neither can be used with mysqlnd/PDO, which (in true Kafkaesque fashion) "no longer allows you" to set a default config file at the mysql level.

Instead it has to parse_ini_file the same .cnf file, and does not read any default option files. mysqlnd apparently does not take any config files as argument.

Everything I read tells me not to use the "default" connection args as command arguments.

  • If I parse_ini_file the mysqldump config file my.cnf or HOST.cnf, does PDO simply pipe that to mysqlnd arguments in plaintext as a (linux process) command? (as arguments)

  • Can I have a single config file with two database connections if I list each separately using mysqldump's default prefix option and then parse_ini_file in PHP to pick the right one? *

  • Is there any point to hiding the PDO connect args in a config file if they are piped to mysqlnd in plain text? (Given how strenuously it is argued against doing the same in mysqldump shell script?)

    *Edited: nope, can't even do that, neither mysqlnd nor mysqldump uses --defaults-group-suffix. Do I have to use a separate .cnf file per-host to share with both mysqlnd (using PHP's parse_ini_file) and mysqldump?

  • So basically the gist of my question is, what's the point of not using mysql password as an argument for mysqldump at the command line if php (pdo) calls mysqlnd as a script with password as an argument? (...or does it?) Because the password "protection" mechanism of these tools seems seriously screwed up. – Ber Aug 21 '16 at 7:07
  • Should I move this to ServerFault? Not sure where to go for help on this. mysqldump on my webhost does not appear to be using defaults-file or defailts-group-suffix at all. If PDO outputs the connect args in plaintext to a mysqlnd command then I don't see the point in not doing so in mysqldump using php. – Ber Aug 22 '16 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.