title: php and mysql - is this secure?
body: <p>I am currently developing a website and a web app (different code) that will share the same data, and this data is stored inside a database. I made it this way:</p>
  <p>I have two domains</p>
  <blockquote>
  <p>Domain 1 -&gt; contains the utilities (ie. php files to query the db)</p>
  <p>Domain 2 -&gt; contains the website</p>
  </blockquote>
  <p>from <code>domain2</code> i send a request to <code>http://domain1.com/utilities/php/domain2/get_from_db.php</code> and this gives me back the result i need.</p>
  <p>My fear is that this is no secure, as the files are somehow exposed?</p>
  <p>It used to be an empty website, and if you were to navigate to <a href="http://domain1.com/" rel="nofollow noreferrer">http://domain1.com/</a> the file structure was visible. I now created an empty <code>index.php</code> file, so that the file structure is not visible anymore.</p>
  <p>I have the impression this is still not really secure, am i correct?</p>
  <p>the database files are the following:</p>
  <blockquote>
  <p>config.ini</p>
  <p>get_from_db.php</p>
  </blockquote>
  <p>the <code>get_from_db.php</code> has this code to connect and get the data back from the db:</p>
  <pre><code>header(&quot;Access-Control-Allow-Origin: http://domain2.com&quot;);
  $db = new mysqli($host, $config['username'], $config['password'], $config['dbName');
  
  if ($db-&gt;connect_errno &gt; 0) {
      die('Unable to connect to database [' . $db-&gt;connect_error . ']');
  }
  
  if (mysqli_connect_errno()) {
      echo &quot;Failed to connect to MySQL: &quot; . mysqli_connect_error();
  }
  
  
  class data
  {
      public $id = &quot;&quot;;
      public $col1 = &quot;&quot;;
      public $col2 = &quot;&quot;;
      public $col3 = &quot;&quot;;
      public $col4 = &quot;&quot;;
  }
  
  $sql = &quot;SELECT * FROM myDb.myTable&quot;;
  $result = mysqli_query($db, $sql) or die(mysqli_error($db));
  
  $obj = array();
  
  while ($row = $result-&gt;fetch_assoc()) {
      $col1 = $row['col1'];
      $col2 = $row['col2'];
      $col3 = $row['col3'];
      $col4 = $row['col4'];
  
      $e = new cvdata();
      $e-&gt;col1 = $skills;
      $e-&gt;col2 = $hobbies;
      $e-&gt;col3 = $education;
      $e-&gt;col4 = $experience;
      array_push($obj, $e);
  
  }
  
  echo json_encode($obj);
  </code></pre>
  <p>now, my final question is:</p>
  <p>Is this level of security enough? (I mean, I know about login and so on, but this is a very simple project and the data should be available to everyone tries to use the website or the app as it is not sensitive at all (it is just some project's details, that's all))</p>
  <p>Thanks for any help, suggestion or advice</p>