Protecting a SQLite database file

[mburt]

Pfft... screw that, just encrypte the stored data (passwords for example). If someone does hack it, they won't know what encrypted it, so it would be impossible to reverse.

[blm126]

Move the file out of the web root.

I thought of this, but was hoping someone would know of an easier way. When the code is deployed on a couple different servers, it gets annoying to have to change the SQLite file path.

Another option (best used in tandem with moving it out of the web root) is to encrypt the file in some manner

The passwords are already encrypted with md5, are you talking about encrypting everything. I can imagine that would cause a performance hit.

Pfft... screw that, just encrypte the stored data (passwords for example). If someone does hack it, they won't know what encrypted it, so it would be impossible to reverse.

Not really. It wouldn't take them long to realize it is a PHP script, and that there aren't that many reversible encryption schemes out there for PHP, and I don't have the knowledge to write my own.

Since I stick to Apache servers could .htaccess be used? I'm not sure how.

[Twey]

I thought of this, but was hoping someone would know of an easier way. When the code is deployed on a couple different servers, it gets annoying to have to change the SQLite file path.

You could also put it in a directory under the web root without read or execute privileges, and take those privileges from the file itself too.

The passwords are already encrypted with md5, are you talking about encrypting everything. I can imagine that would cause a performance hit.

I was, and it would.

there aren't that many reversible encryption schemes out there for PHP

There are plenty.

Since I stick to Apache servers could .htaccess be used? I'm not sure how.

Yes, you could:

<Files mydatabase.db>
  Deny From All
</Files>

... or similar.

[blm126]

:

<Files mydatabase.db>
  Deny From All
</Files>

... or similar.

Thanks Twey, that's perfect.