Security issues while using external javascript and php files to access mysql database in drupal nodes

Question

I have created a search_interface node which asks for filters and onClick event of the submit button, I have called an external search.js script. My search_interface node is of a custom content type Query(this content type has no extra fields other than the default fields created by a new content type)

This script uses getElementById() to get user input and send it to an external php script using POST method. This script uses mysqli_connect() to connect to my database and then does query on the required table(only 1 table is being queried everytime). The result of mysqli_query() is passed back to the search.js script using json_encode() and in the search.js script, I have parsed this jsonData and created a table string. Then I have used my_table.innerHTML = "table string" to finally display the query on the drupal node.

• Is this method secure?

• Can some anonymous user access my .php script and get to know my mysql admin password? ( I use admin password during mysqli_connect() )

• Can my whole database be exposed easily even though I always query a single table of the database?

• Can the .php file be edited to update or delete parts of my database or the table in which I query every time?

Please help as I am new to drupal 6 and don't know much about security of php files and drupal nodes.

Answer 1

Doesn't look like any of the questions you have are directly related to Drupal. I highly suggest reading about PHP security concerns. This is a good resource to get started.

That said:

Is this method secure?

Without looking at specific code, that is hard to say. Since you're running a database query based on user input, it's important you properly sanitize the input before running the query. I suggest using PDO instead of mysqli_* functions, since PDO is more widely used now and provides easy ways to use "prepared statements" to protect your database.

Can some anonymous user access my .php script and get to know my mysql admin password? ( I use admin password during mysqli_connect() )

Not unless the .php script prints the password to the screen. Sounds like it accepts POST data and will return JSON output with data from the database. Make sure your POST data in sanitized before running a query.

Can my whole database be exposed easily even though I always query a single table of the database?

See above

Can the .php file be edited to update or delete parts of my database or the table in which I query every time?

Not unless a malicious user has access to your web server