if you need to store a database password then clearly the first step is to store the text outside the web tree you can encrypt it and store the encryption key elsewhere so that at least an attacker has to get two different things also don t get full privileges create a user account that is granted very limited access however you can often do better than this if security is critical create a separate program which has these database keys as noted above and make the web program contact it create a very limited protocol that only lets you do the operations you need you can add specific operations later there s a performance hit which you re trading for improved data isolation giorgio zoppi wrote on fri aug NUMBER NUMBER david wheeler wrote the standard way to store passwords is not to store passwords instead store a salted hash of the password in a database when you get a purported password you re salt it compute the hash and determine if they are the same this is how unix has done it for years you want bigger hashes and salts than the old unix systems and you still want to prevent reading from those files to foil password crackers more info is in my book at URL well but this cannot be applied to database password which most web apps use the only solution i figure is store in clear outside web tree any other ideas feasible ciao giorgio never is forever deneb URL homepage URL david a wheeler dwheeler URL 