php, databases, and ssl

[dave1236]

All:

I am having issues with my implementing an ssl page to secure my site. My database access is password protected, but the issue is the actual transmission of the data from the login.php page to the database. A user was concerned about the security of this aspect, which is understandable.

What I want to do is find a way to have the query of the database take place behind a ssl layer, and once that is accomplished, leave that area. Quite simply, after login, all I do is access their name to greet them, and use their username as a session variable. I use Yahoo web hosting, and they have a ssl folder to use to get security. I tinkered with things, but couldn't figure out what links needed to be changed, nor how to properly direct the changes.

I was able to get it to work somewhat, but once I tried to login, I kept getting in a loop that reloaded the login page.

I hope this is enough information, although I have a premonition that it is difficult to answer this query without access to the code.

Any of your expertise is greatly appreciated.

[Adrian2k4]

I don't think a DB-query needs to be SSL encrypted, since the DB-query isn't sent over the WWW, it's processed within the server.

[dave1236]

Thanks. I was told the same thing from another person, but wasn't quite aware of the specifics and wanted to verify.

[coopster]

The login page itself should be encrypted though. Otherwise the userid and password are being passed over the internet in plain text.

[henry0]

You can even have a full set of your website totally under SSL
Create a Symlink from your WWW to the SSL protected secure area (or ask the ISP to set it up)
using either your own certificat or a your ISP shared one (if they offer such a deal)

regards

Henry