If you are using something like app -> db calls to be done automatically on a server, hashed passwords won't help since the script usually requires a stored non

If you are using something like app -> db calls to be done automatically on a server, hashed passwords won't help since the script usually requires a stored non-hashed key unless it accepts hashed keys. Even then, if the password or hashed password is exposed, the hacker can still use it to access the database via your app. Maybe you want decentralised permissions of multiple database users? They can't quite get or do most things. Or centralised and/or put into a locked down file that can only be accessed by the OS user for parsing scripts eg www-data. More references: http://technet.microsoft.com/en-us/library/cc722487.aspx#EIAA http://technet.microsoft.com/en-us/library/cc722487.aspx#EIA... http://us.php.net/manual/en/security.php http://us.php.net/manual/en/security.php (Or check your relevant manual) http://blogs.forbes.com/firewall/2010/12/13/the-lessons-of-gawkers-security-mess/ http://blogs.forbes.com/firewall/2010/12/13/the-lessons-of-g... http://stackoverflow.com/questions/3173698/how-safe-is-code-hosted-elsewhere http://stackoverflow.com/questions/3173698/how-safe-is-code-...