http://qs1969.pair.com?node_id=1183309


in reply to How can a script use a password without making the password visible?

A coder with access to the script can do anything with the password, including printing it to the console. They can read the entire database too, or wipe tables. So, if you cannot trust your coders, you have a huge problem.

If your real fear is that outsiders accidentally get read access to the code, and can see the password, then I would recommend restricting access using the password to localhost — or for an IP address on your local network. MySQL (and, thus, MariaDB) allow you to define a login (user/password combination) that doesn't work remotely, and I'm quite sure PostGres does too.

In fact, I often use no password for a restricted user, in applications on a website. You cannot login without password in PHPMyAdmin, and other similar database CRUD tools (which actually work on localhost/intranet). So, having no password actually protects you from such hackers.