MySql User with Multiple DBs Advice

Question

I have recently created a Joomla 3.3 website which consists of one user (all privileges) and one database on my shared hosting account.

I'd now like to install Piwik analytics aswell on the same hosting account (http://piwik.org/).

What would be the best way of approaching this as regards users? Piwik requires one db user with all privileges.

• Can I use the same user to manage my Joomla site and Piwik?
• Is there a security risk by doing this?
• Will there be any effect on site performance/speed?

I'm not sure if it makes much difference, however if somebody could point me in the right direction I would be most grateful.

I would like to keep things as simple as possible because my shared hosting (BT) does not allow users to modify db user privileges - and my client wants to stay with BT. Therefore each time I set up a user I have to contact them and wait (up to) 48hours for a response.

I'm quite new to DBs so apologies for the naive question.

Regards

Answer 1

On shared hosters it's quite usual that you only have one db user. Of course it is not best security practice to run various web applications with the same "root" db user. But on shared hosters you are usually stuck with what you have.

The danger is if you are being hacked and someone gets your credentials or can run code using your connections. Then he can do anything with your database. If it's only one user, he will have access to all your databases. However hackers usually are most interested in the actual data (credit cards, emails, passwords and the like). They don't want to modify your database. Thus even a restricted user would allow them to get what they want. So it's not really that big of an issue if you have only one user with all privileges.

In theory you can also have Piwik and Joomla withing the same database. You can even run multiple Joomla instances in the same database as long as you have different prefixes. I wouldn't care about the performance, that should not be a problem at all. For me the main reason to have each application in its own database is the maintainability. For example it's easier to make and restore backups for a specific application and it's clear which database does what.

So if you have the ability to create unique users and databases for each application, it's certainly good practice to do so. However if you can't do that, I wouldn't invest much time to get it done.