Hi,
I'm getting more into the database security side of my web apps. Creating separate users for select, insert,delete etc. and then granting each user specific privaleges on different tables, sprocs etc.
The issue I'm having though is that for some reason, a lot of my queries fail when passing in a resource identifier.
$dbr = mysql_connect($host,$name,$pass);//dbr only has select
mysql_select_db($db,$dbr);
$dbw = mysql_connect($host1,$name2,$pass3);//dbw can insert update etc.
mysql_select_db($db,$dbw);
The problem I have is that when i then do something such as
$q = mysql_query("insert into table(field) values(value)", $dbw);
I'll receive an error with regards to the invalid resource identifier. What's the best way to go about this kind of setup. Shoud I use a function that returns the correct handle such as
function getConn($key){
$dbh;
switch($key){
case "reader":
$dbh = mysql_connect($host,$name,$pass);
break;
case "writer":
$dbh = mysql_connect($host1,$name1,$pass1);
break;
case default:
$dbh = mysql_connect($host,$name,$pass);
break; // reader only
}
mysql_select_db($db, $dbh);
return $dbh;
}
Would appreciate thoughts on this, as it is one thing I really want to master.
thanks