Secure database password using a SQL connection

Question

I want to program a Java Applet that connects to my personal MySQL database.

Now my question is: Can somebody e.g. open the class-file(s) from the JAR and look for the password/string? (Of course I would exclude the source files when I generate the JAR.) So is it insecure to put the password (as a plain string) in the code?

If it is insecure, what would you suggest. Obfuscator? No direct connection (e.g. using PHP-scripts)? Other options?

And how will you secure the password the the PHP service?

Ignacio Vazquez-Abrams
– Ignacio Vazquez-Abrams

2010-11-25 10:33:10 +00:00
Commented Nov 25, 2010 at 10:33 — Ignacio Vazquez-Abrams
– Ignacio Vazquez-Abrams, Commented Nov 25, 2010 at 10:33

Mario · Accepted Answer · 2010-11-25 10:34:04Z

2

It's in general a bad idea as anyone could as well just sniff the packets sent. You should write a small web service (simple php/asp page) that handles authentication through http get/post and only submits requests you permit (e.g. avoid someone sniffing the username/password and then drop the database or modify it).

Also let the user create his/her own account to submit. If you're talking about some proposed high score functionality, just submit the name, highscore and some kind of checksum (and maybe some token) but there's no 100% secure way to do it.

answered Nov 25, 2010 at 10:34

Mario

36.7k5 gold badges70 silver badges87 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Secure database password using a SQL connection

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related