Is it possible to run PHP exec() but hide params from the process list?

Question

I'd like to have a properly protected PHP web-based tool to run a `mysqlcheck` for general database table health, but I don't want the password to be visible in the process list. I'd like to run something like this: ``` $output = shell_exec('mysqlcheck -Ac -uroot -pxxxxx -hhostname'); // strip lines that's OK echo '

'.preg_replace('/^.+\sOK$\n?/m', '', $output).'

'; ``` Unfortunately, with a `shell_exec()`, I have to include the password in the command line, but am concerned that the password will show up in the process list (`ps -A | grep mysqlcheck`). Using mariadb 5.5 on my test machine, mysqlcheck doesn't show the password in the process list, but my production machine isn't running mariadb and running a different OS and I'd like to be on the safe-side and not run these tests on the production side. Do all versions of mysql also hide the password in the process list? Are my concerns a non-issue?

Accepted Answer

Yes, since at least MySQL 5.1, the client obscures the password on the command-line.

I found this blog by former MySQL Community Manager Lenz Grimmer from 2009, in which he linked to the relevant code in the MySQL 5.1 source. http://www.lenzg.net/archives/256-Basic-MySQL-Security-Providing-passwords-on-the-command-line.html

You could alternatively not pass the password on the command-line at all, and instead store the user/password credentials in a file which PHP has privileges to read, and then execute the client as:

```
mysqlcheck --defaults-extra-file=/etc/php.d/mysql-client.cnf
```

The filename is an example; you can specify any path you want. The point is that most MySQL client tools accept that `--defaults-extra-file` option. See http://dev.mysql.com/doc/refman/5.6/en/option-file-options.html for more information.

Is it possible to run PHP exec() but hide params from the process list?

Solution

Problem