Where to locate Connections folder?

Question

Hi,
I've noticed that DW places the Connection folder in the site
root which
seems to me to be a very bad place for security reasons. So
my question
is, where is best place to put the Connection folder for a
site, and how
do you do that from within DW when all site files are within
the site
folder? Also, if you move the Connections folder somewhere
above the
www folder, how will DW handle the path?
TIA

Answer 1

Brett wrote:
> Hi Steve,
>
> Below is a quote from a class I took in PHP/MySQL and
the instructor
> made specific mention of this issue, which is why I
bring it up.
>
> "The most sensitive information you have in your
application is the
> login information to your MySQL database server,
contained in the
> /mysql_connect()/ function. If hackers got a hold of
this file, they'd
> know the user name and password for your MySQL database.
That could be
> potentially bad.
>
> To prevent that problem, we'll create a separate PHP
function called
> login() and save it in an alternative location. To keep
things simple,
> I'm just including it in the mylibrary folder under our
store folder. In
> real practice, it would be best to place it in a folder
out of the
> Apache Web server's path so it's not accessible via the
Web."
>
> Certainly a normal visitor would not have any reason to
do harm, nor
> would they know where to begin. But with the malicious
nature of some
> people, I wonder if there is not a safer approach. Since
I'm not a
> hacker, I don't know how to exploit security weaknesses,
but I certainly
> don't want to give them the opportunity.
> Now, if this setup is perfectly safe and I really have
nothing to worry
> about, I'll let it be.
>
> As always Steve, thanks for taking the time.
Hi Brett,
I agree that there are nasty hackers out there looking for
ways in to
get sensitive data, but there are also millions of potential
websites
for them to hack, and they normally pick ones where they have
something
to gain. If your site has data that is critically sensitive,
then you
need to be getting a security expert to certify your code,
and if that
was the case, I wouldn't think Dreamweaver would be the tool
of choice
to create the code.
Macromedia responded to sql injection security alerts when
they were
identified, there was a major change in all the recordset
code and
behaviours, and this was in 8.02, so they took if very
seriously, if
there was a serious flaw in the way connection folders are
used, don't
you think that would have been addressed by now?
One thing I always forget to do is remove the scripts folder
from my
live site after making tweaks to pages, as that folder is one
that
contains code that will leave your site open to abuse. It
under the site
menu, then advanced, and is called remove connection scripts.
This isn't
the connections folder, its the _mmServerScripts folder, its
copied to
the server each time you open a recordset, so you need to
remove it once
your done.
The advice from Adobe is to not copy them onto a live site,
but its easy
to forget that the folder is there after you have made a
quick change
that involves a recordset or server behaviour. Here is some
more
information:
http://kb.adobe.com/selfservice/viewContent.do?externalId=tn_16566
Steve