configuring a server with PHP4+MySQL

[zybler]

I got P4 PC and i decided to network it together with a celeron PC. I decided that the P4 PC should be a server and the celeron PC should be a client (local).

Ok. Now I want to configure P4 PC to be able to host PHP4 scripts and use MySQL (and apache) so i download and install the following:

http://www.firepages.com.au/phpdev41.htm

The P4 PC is connected to the Internet (sometimes). Since it's installed with Windows XP and has built-in firewall, i disabled the firewall and install Zone Alarm Pro.

Now, assuming that server is connected to the net, will my Apache server, my PHP scripts and my MySQL database safe from hackers? What about hacker stealing files by means of hard disk sharing? how do i disabled that? (I also haven't set root password for MySQL, maybe even Apache)

How do i configure Apache, MySQL to make it more secure? Possibly atleast give them a password? But how? What are the steps?

Since the server is locally-networked and got 1 local client, how do i configure both machines, so that from the local client, i can access the intranet page stored on the server (served by the apache server and mysql server on the P4 PC).

NOTE: I want the apache to serve only to local client(s), not through the Internet! since it's a private, local intranet program (it's written in PHP and MySQL)... I don't want anyone outside the intranet to access to the intranet or attempt to log-in to the private intranet prigram.

THANKS in advanced

[oracleguy]

Try looking at:
http://httpd.apache.org/docs-2.0/

You could also setup a .htacess file for your intranet. See: http://www.javascriptkit.com/howto/htaccess.shtml

As far as mysql is concered, you should make sure the username 'root' has a password on it. And you could set up another user inside mysql with a password to run queries. This would prevent anyone from easily accessing the mysql server from the internet.

[zybler]

I just set a password for the 'root' account through phpMyAdmin but strangely, i can still open phpMyAdmin without entering any password and proceed to create new database and drop databases without any problem? wouln't it be a concern if a hacker somehow got access and drop my databases?

[oracleguy]

You need to add a .htaccess file to the folder with the phpMyAdmin so that you have to enter a username and password in to access any files in that directory.