Frequently Asked Questions

The NearlyFreeSpeech.NET FAQ (*)

MySQL (*)

Q. Why shouldn't I use my MySQL admin username from my web site?

When setting up your site's MySQL connection information, it's tempting to skip the step of creating an additional user and use the admin username (your member login name) and password. Never do that!

The first and most important reason not to do this is security. Storing your MySQL administrator password in plain text as part of your publicly accessible website is a really bad idea. The slightest vulnerability in your application, the web server software, or the operating system could result in a complete takeover of your MySQL process, rendering it unrecoverable to you.

Your website doesn't need administrator privileges against your database. It needs some subset of that, and creating a dedicated MySQL user for your site with only the necessary privileges is a good way to limit exposure to SQL injection attacks and other security issues.

Second, your admin username has the SUPER privilege. MySQL only allows a certain number of connections at a time. If it runs out, either due to a problem with your application or a glitch in the MySQL process itself, your site will start getting "too many connections" errors. However, to make sure you can get in and fix it, MySQL always holds a single connection aside for a user with the SUPER privilege. If your site is using your admin username, you'll be unable to resolve the issue yourself because that "rescue" connection will already have been wasted by the site. If you find yourself in that situation, the "Kill Database Process" action on the Database Process Information panel for your process should be able to resolve it. But that option should not be used lightly, as it carries a small risk of data corruption. (In the case where your database is inaccessible because all connections are in use, this risk is typically negligible, but it is still a possibility.)

So remember, using your MySQL admin username from your site is a terrible idea. It seems easy and harmless up front, but sooner or later you will wind up regretting it.