是否可以通过知道PHP中的用户名和密码（仅限）来破解我的数据库[关闭]

Question

Is it possible for someone to hack a MySQL database by knowing (only) the username and the password for my database.

There is no phpMyAdmin to login from it and there is no way to do any SQL injection in the website (because I'm using Laravel).

Answer 1

Your question is quite similar to "Is it possible to break into my house with my door key?"

It depends on few things:

1. Which IP is your MySQL listening to? In your MySQL Config File bind-address, find the value.
2. For that specific username, did you enabled remote access for that user in MySQL?
3. Any Firewall rules to restrict remote MySQL connections?

By the way, using Laravel or any other frameworks does NOT guarantee anything on protecting from SQL injection. People can easily write a SQL injection vulnerable web page under any framework if they want.

You should:

• Implement your database related code properly and follow the instruction in the documentation.
• Set your MySQL users and their privilege in the right way.
• Do not expose your database to the public is recommended.

Last thing for your update, if you want to share your database with others. Not a big problem if you set the privilege correctly.