# Database credentials inside the client

**URL:** <https://forums.unrealengine.com/t/database-credentials-inside-the-client/90162>\
**Category:** Blueprint\
**Tags:** unreal-engine\
**Created:** [April 18, 2017, 9:58am UTC](https://forums.unrealengine.com/t/database-credentials-inside-the-client/90162 "2017-04-18T09:58:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![anonymous\_user\_b6a3f31b](https://d3kjluh73b9h9o.cloudfront.net/original/4X/2/8/5/28502927f1d97ba1051b3b47ccfe17233bf41ef0.png) [@anonymous\_user\_b6a3f31b](https://forums.unrealengine.com/u/anonymous_user_b6a3f31b)\
**Post date:** [April 18, 2017, 9:58am UTC](https://forums.unrealengine.com/t/database-credentials-inside-the-client/90162/1 "2017-04-18T09:58:54Z")

</div>

Hello everybody.  
I was making an online game and I was performing the database. Looking around the forum I saw a lot of people speaking about php and JSON requests. I found a plugin called “MYSQLConnectorUE4 Plugin” that make a connection between client and database using blueprints.  
My quesion is: The credentials of the database as username, password, host are inside the blueprints so inside the client, but is this way secure for the credentials of the database? Can’t somebody stole that after that I package the game? Thank you.

---

<div class="post-metadata">

**Author:** ![qdelpeche](https://d1ap1mz92jnks1.cloudfront.net/user_avatar/forums.unrealengine.com/qdelpeche/32/776509_2.png) [@qdelpeche](https://forums.unrealengine.com/u/qdelpeche)\
**Post date:** [April 18, 2017, 11:45am UTC](https://forums.unrealengine.com/t/database-credentials-inside-the-client/90162/2 "2017-04-18T11:45:34Z")

</div>

It is not secure at all and should be avoided under all circumstances. Even if you use a dedicated server model, you still have database credentials sitting inside your application and this can potentially be a huge security risk.

The correct way of addressing this is to use a RESTful (or other type of web-service). Run your web-service off HTTPS and then ensure you have some type of encryption on your payload as well as a one-way encrypted checksum to ensure no data is modified during payload delivery. Your web-service should then do all payload validation and data verification before is hands the data off to your database for storage or retrieval.

No matter what anyone says, whether you encrypt the credentials or even only use read or limited access credentials, storing this type of information inside an executable that you have no control over anymore (because it will be distributed to many potential users) is bad practice. Also remember that every client will now open a connection to your database server and depending on how many clients you have, you could end up running out of sockets on your server hosting the database … which is bad.

By using a web-service you are able to scale your solution out and the clients will only ever have an HTTPS connection to your web-service which is what it is intended to support and you can literally handle exponentially more connections. Your web-service should also incorporate database connection pooling as well.

---

<div class="post-metadata">

**Author:** ![anonymous\_user\_b6a3f31b](https://d3kjluh73b9h9o.cloudfront.net/original/4X/2/8/5/28502927f1d97ba1051b3b47ccfe17233bf41ef0.png) [@anonymous\_user\_b6a3f31b](https://forums.unrealengine.com/u/anonymous_user_b6a3f31b)\
**Post date:** [April 18, 2017, 12:45pm UTC](https://forums.unrealengine.com/t/database-credentials-inside-the-client/90162/3 "2017-04-18T12:45:29Z")

</div>

Thanks for you reply.  
I made the dedicated server using this guide:

> **[A new, community-hosted Unreal Engine Wiki](https://forums.unrealengine.com/t/a-new-community-hosted-unreal-engine-wiki/141494)**
>
> After over a year in maintenance mode, the official Unreal Engine Wiki is now permanently offline. These resources now live on a new community-run Unreal Engine Community Wiki — https://unrealcommunity.wiki/! You will be able to find content from...

This guide explain how to make the server, so I compiled the modified source with the new file “PROJECTNAMEServer.Target.cs” and now I have a file called “PROJECTNAMEServer.exe”, but, where are the files to modify that?  
I prefer to make this kind of connection:  
Client -\> Server -\> DB -\> Server -\> Client