We have a web application based on the famous triad apache + php + mysql which we sell to our customers and gets installed on their servers.
Currently, we are using MySQL 5.1.41 which has only a single user registered, root
, with is password and access allowed only from localhost.
The problem is, if someone creates its own mysql installation, and then copies our database from its original location to that independent installation, s/he would be able to access its content.
Is there a way to prevent also this kind of improper access to our webapp database? Can it be encorder MySQL-side or must it be something in our own application?