开发者

Securely insert into database using just Ruby

开发者 https://www.devze.com 2023-03-03 23:10 出处:网络
I\'ve got the following function... dbh = DBI.connect(\'DBI:Mysql:activity\',\'username\',\'password\')

I've got the following function...

 dbh = DBI.connect('DBI:Mysql:activity','username','password')
sql = "insert into num (date,number) values('#{date}','#{value}')"
dbh.do(sql)
dbh.disconnect

However, I don't feel comfortably actually putting this thing live since the username and password are stored in plain text in the file. How would I store the usernam开发者_如何学编程e and password in a secure way that the file can get?

Would passing it when the cron job runs be fine? is there a better way?


Sorry, but there's not really a better way to do this. The script needs to be able to get access to the database. There are thing you can do to reduce the risk of having a breach.

  1. Don't use the same password for test and production.
  2. Give the database user the least possible permissions. In other words, do they not need delete or insert privledges? Take those away. Do they only need one table? Restrict them to that table.
0

精彩评论

暂无评论...
验证码 换一张
取 消