I am setting up a MySQL database and am providing a web interface for it. Now, the DB is extremely simple and the interface just runs certain SELECT statements. I have created a user for my script to use when connecting with these commands:

GRANT SELECT ON dbname.* TO foo

I then have these lines in my Perl script:

my $user = "foo";
my $pw = "bar";


  • The data on the database are completely public and users can use/redistribute them at will. I have no interest in blocking anyone from accessing it, it is to provide a dataset to the scientific community.
  • The data are static, there is no need for anyone to be able to modify them in any way and the only user who has the right to is root (the only other user on the system).

So, my question is, how dangerous is this? Given that the user only has SELECT rights, what bad things can happen with this, clearly insecure, setup? Is there a better way of allowing access to my script bearing in mind the two notes above?


You should always put application passwords in O/S Environment Variables (envvars).

  • Can only be read by the assigned O/S user (or root)
  • You won't accidentally screw up file permissions (if putting passwords in files)
  • You won't accidentally check passwords in to source control (this is particularly important in open source)
  • Survives reboots
  • envvars are easy to read with most languages
  • You should follow the principle of least privilege and run say your web server as its own user.


| improve this answer | |
  • Thanks and +1, an env variable makes a lot of sense. Could you explain what the dangers are though? For example, in the points you make: 1) indeed 2) having the pw in the script also survives reboots 3) not using files 4) not using source control here either (this is the production machine) 5) having it in a script is even easier :P 6) that is already the case, are you suggesting I give the webserver user access to the DB? – terdon Mar 19 '14 at 18:15
  • It's probably not super dangerous in this limited case, but using envvars is a globally good solution, so it's probably worth getting used to so that you use it automatically in other situations. – Neil McGuigan Mar 19 '14 at 18:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.