Installing using Composer¶

You can install phpMyAdmin using the Composer tool, since 4.7.0 the releases
are automatically mirrored to the default Packagist repository.

To install phpMyAdmin simply run:

composer create-project phpmyadmin/phpmyadmin

Alternatively you can use our own composer repository, which contains
the release tarballs and is available at
<https://www.phpmyadmin.net/packages.json>:

composer create-project phpmyadmin/phpmyadmin --repository-url=https://www.phpmyadmin.net/packages.json --no-dev

Installing using Docker¶

phpMyAdmin comes with a Docker official image, which you can easily deploy. You can
download it using:

docker pull phpmyadmin

The phpMyAdmin server will listen on port 80. It supports several ways of
configuring the link to the database server, either by Docker’s link feature
by linking your database container to db for phpMyAdmin (by specifying
--link your_db_host:db) or by environment variables (in this case it’s up
to you to set up networking in Docker to allow the phpMyAdmin container to access
the database container over the network).

<?php
$cfg['Export']['csv_columns'] = true;

<?php
/* Override Servers array */
$cfg['Servers'] = [
    1 => [
        'auth_type' => 'cookie',
        'host' => 'mydb1',
        'port' => 3306,
        'verbose' => 'Verbose name 1',
    ],
    2 => [
        'auth_type' => 'cookie',
        'host' => 'mydb2',
        'port' => 3306,
        'verbose' => 'Verbose name 2',
    ],
];

docker run --name myadmin -d -e PMA_HOST=dbhost -p 8080:80 phpmyadmin/phpmyadmin

docker run --name myadmin -d -e PMA_HOSTS=dbhost1,dbhost2,dbhost3 -p 8080:80 phpmyadmin/phpmyadmin

docker run --name myadmin -d --link mysql_db_server:db -p 8080:80 -e PMA_ARBITRARY=1 phpmyadmin/phpmyadmin

docker run --name phpmyadmin -d --link mysql_db_server:db -p 8080:80 phpmyadmin/phpmyadmin

docker run --name phpmyadmin -d --link mysql_db_server:db -p 8080:80 -v /some/local/directory/config.user.inc.php:/etc/phpmyadmin/config.user.inc.php phpmyadmin/phpmyadmin

docker run --name phpmyadmin -d --link mysql_db_server:db -p 8080:80 -v /custom/phpmyadmin/theme/:/www/themes/theme/ phpmyadmin/phpmyadmin

docker-compose up -d

phpmyadmin:
    image: phpmyadmin/phpmyadmin
    container_name: phpmyadmin
    environment:
     - PMA_ARBITRARY=1
    restart: always
    ports:
     - 8080:80
    volumes:
     - /sessions
     - ~/docker/phpmyadmin/config.user.inc.php:/etc/phpmyadmin/config.user.inc.php
     - /custom/phpmyadmin/theme/:/www/themes/theme/

frontend http
    bind *:80
    option forwardfor
    option http-server-close

    ### NETWORK restriction
    acl LOCALNET  src 10.0.0.0/8 192.168.0.0/16 172.16.0.0/12

    # /phpmyadmin
    acl phpmyadmin  path_dir /phpmyadmin
    use_backend phpmyadmin if phpmyadmin LOCALNET

backend phpmyadmin
    mode http

    reqirep  ^(GET|POST|HEAD) /phpmyadmin/(.*)     1 /2

    # phpMyAdmin container IP
    server localhost     172.30.21.21:80

defaultEntryPoints = ["http"]
[entryPoints]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
      regex = "(http:\/\/[^\/]+\/([^\?\.]+)[^\/])$"
      replacement = "$1/"

[backends]
  [backends.myadmin]
    [backends.myadmin.servers.myadmin]
    url="http://internal.address.to.pma"

[frontends]
   [frontends.myadmin]
   backend = "myadmin"
   passHostHeader = true
     [frontends.myadmin.routes.default]
     rule="PathPrefixStrip:/phpmyadmin/;AddPrefix:/"

version: '2'

services:
  phpmyadmin:
    restart: always
    image: phpmyadmin/phpmyadmin
    container_name: phpmyadmin
    hostname: phpmyadmin
    domainname: example.com
    ports:
      - 8000:80
    environment:
      - PMA_HOSTS=172.26.36.7,172.26.36.8,172.26.36.9,172.26.36.10
      - PMA_VERBOSES=production-db1,production-db2,dev-db1,dev-db2
      - PMA_USER=root
      - PMA_PASSWORD=
      - PMA_ABSOLUTE_URI=http://example.com/phpmyadmin/

Quick Install¶

1. Choose an appropriate distribution kit from the phpmyadmin.net
   Downloads page. Some kits contain only the English messages, others
   contain all languages. We’ll assume you chose a kit whose name
   looks like phpMyAdmin-x.x.x -all-languages.tar.gz.

2. Ensure you have downloaded a genuine archive, see Verifying phpMyAdmin releases.

3. Untar or unzip the distribution (be sure to unzip the subdirectories):
   tar -xzvf phpMyAdmin_x.x.x-all-languages.tar.gz in your
   webserver’s document root. If you don’t have direct access to your
   document root, put the files in a directory on your local machine,
   and, after step 4, transfer the directory on your web server using,
   for example, FTP.

4. Ensure that all the scripts have the appropriate owner (if PHP is
   running in safe mode, having some scripts with an owner different from
   the owner of other scripts will be a problem). See 4.2 What’s the preferred way of making phpMyAdmin secure against evil access? and
   1.26 I just installed phpMyAdmin in my document root of IIS but I get the error “No input file specified” when trying to run phpMyAdmin. for suggestions.

5. Now you must configure your installation. There are two methods that
   can be used. Traditionally, users have hand-edited a copy of
   config.inc.php, but now a wizard-style setup script is provided
   for those who prefer a graphical installation. Creating a
   config.inc.php is still a quick way to get started and needed for
   some advanced features.

<?php
// use here a value of your choice at least 32 chars long
$cfg['blowfish_secret'] = '1{dd0`<Q),5XP_:R9UK%%8"EEcyH#{o';

$i=0;
$i++;
$cfg['Servers'][$i]['auth_type']     = 'cookie';
// if you insist on "root" having no password:
// $cfg['Servers'][$i]['AllowNoPassword'] = true;

<?php

$i=0;
$i++;
$cfg['Servers'][$i]['user']          = 'root';
$cfg['Servers'][$i]['password']      = 'changeme'; // use here your password
$cfg['Servers'][$i]['auth_type']     = 'config';

/usr/sbin/pma-configure

/usr/sbin/pma-secure

Verifying phpMyAdmin releases¶

Since July 2015 all phpMyAdmin releases are cryptographically signed by the
releasing developer, who through January 2016 was Marc Delisle. His key id is
0xFEFC65D181AF644A, his PGP fingerprint is:

436F F188 4B1A 0C3F DCBF 0D79 FEFC 65D1 81AF 644A

and you can get more identification information from <https://keybase.io/lem9>.

Beginning in January 2016, the release manager is Isaac Bennetch. His key id is
0xCE752F178259BD92, and his PGP fingerprint is:

3D06 A59E CE73 0EB7 1B51 1C17 CE75 2F17 8259 BD92

and you can get more identification information from <https://keybase.io/ibennetch>.

Some additional downloads (for example themes) might be signed by Michal Čihař. His key id is
0x9C27B31342B7511D, and his PGP fingerprint is:

63CB 1DF1 EF12 CF2A C0EE 5A32 9C27 B313 42B7 511D

and you can get more identification information from <https://keybase.io/nijel>.

You should verify that the signature matches the archive you have downloaded.
This way you can be sure that you are using the same code that was released.
You should also verify the date of the signature to make sure that you
downloaded the latest version.

Each archive is accompanied by .asc files which contain the PGP signature
for it. Once you have both of them in the same folder, you can verify the signature:

$ gpg --verify phpMyAdmin-4.5.4.1-all-languages.zip.asc
gpg: Signature made Fri 29 Jan 2016 08:59:37 AM EST using RSA key ID 8259BD92
gpg: Can't check signature: public key not found

As you can see gpg complains that it does not know the public key. At this
point, you should do one of the following steps:

• Download the keyring from our download server, then import it with:

$ gpg --import phpmyadmin.keyring

• Download and import the key from one of the key servers:

$ gpg --keyserver hkp://pgp.mit.edu --recv-keys 3D06A59ECE730EB71B511C17CE752F178259BD92
gpg: requesting key 8259BD92 from hkp server pgp.mit.edu
gpg: key 8259BD92: public key "Isaac Bennetch <bennetch@gmail.com>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)

This will improve the situation a bit – at this point, you can verify that the
signature from the given key is correct but you still can not trust the name used
in the key:

$ gpg --verify phpMyAdmin-4.5.4.1-all-languages.zip.asc
gpg: Signature made Fri 29 Jan 2016 08:59:37 AM EST using RSA key ID 8259BD92
gpg: Good signature from "Isaac Bennetch <bennetch@gmail.com>"
gpg:                 aka "Isaac Bennetch <isaac@bennetch.org>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 3D06 A59E CE73 0EB7 1B51  1C17 CE75 2F17 8259 BD92

The problem here is that anybody could issue the key with this name. You need to
ensure that the key is actually owned by the mentioned person. The GNU Privacy
Handbook covers this topic in the chapter Validating other keys on your public
keyring. The most reliable method is to meet the developer in person and
exchange key fingerprints, however, you can also rely on the web of trust. This way
you can trust the key transitively though signatures of others, who have met
the developer in person.

Once the key is trusted, the warning will not occur:

$ gpg --verify phpMyAdmin-4.5.4.1-all-languages.zip.asc
gpg: Signature made Fri 29 Jan 2016 08:59:37 AM EST using RSA key ID 8259BD92
gpg: Good signature from "Isaac Bennetch <bennetch@gmail.com>" [full]

Should the signature be invalid (the archive has been changed), you would get a
clear error regardless of the fact that the key is trusted or not:

$ gpg --verify phpMyAdmin-4.5.4.1-all-languages.zip.asc
gpg: Signature made Fri 29 Jan 2016 08:59:37 AM EST using RSA key ID 8259BD92
gpg: BAD signature from "Isaac Bennetch <bennetch@gmail.com>" [unknown]

Upgrading from an older version¶

Simply copy config.inc.php from your previous installation into
the newly unpacked one. Configuration files from old versions may
require some tweaking as some options have been changed or removed.
For compatibility with PHP 5.3 and later, remove a
set_magic_quotes_runtime(0); statement that you might find near
the end of your configuration file.

The complete upgrade can be performed in a few simple steps:

1. Download the latest phpMyAdmin version from <https://www.phpmyadmin.net/downloads/>.

2. Rename existing phpMyAdmin folder (for example to phpmyadmin-old).

3. Unpack freshly downloaded phpMyAdmin to the desired location (for example phpmyadmin).

4. Copy config.inc.php` from old location (phpmyadmin-old) to the new one (phpmyadmin).

5. Test that everything works properly.

6. Remove backup of a previous version (phpmyadmin-old).

If you have upgraded your MySQL server from a version previous to 4.1.2 to
version 5.x or newer and if you use the phpMyAdmin configuration storage, you
should run the SQL script found in
sql/upgrade_tables_mysql_4_1_2+.sql.

If you have upgraded your phpMyAdmin to 4.3.0 or newer from 2.5.0 or
newer (<= 4.2.x) and if you use the phpMyAdmin configuration storage, you
should run the SQL script found in
sql/upgrade_column_info_4_3_0+.sql.

Do not forget to clear the browser cache and to empty the old session by
logging out and logging in again.

Securing your phpMyAdmin installation¶

The phpMyAdmin team tries hard to make the application secure, however there
are always ways to make your installation more secure:

• Follow our Security announcements and upgrade
  phpMyAdmin whenever new vulnerability is published.

• Serve phpMyAdmin on HTTPS only. Preferably, you should use HSTS as well, so that
  you’re protected from protocol downgrade attacks.

• Ensure your PHP setup follows recommendations for production sites, for example
  display_errors
  should be disabled.

• Remove the test directory from phpMyAdmin, unless you are developing and need a test suite.

• Remove the setup directory from phpMyAdmin, you will probably not
  use it after the initial setup.

• Properly choose an authentication method – Cookie authentication mode
  is probably the best choice for shared hosting.

• Deny access to auxiliary files in ./libraries/ or
  ./templates/ subfolders in your webserver configuration.
  Such configuration prevents from possible path exposure and cross side
  scripting vulnerabilities that might happen to be found in that code. For the
  Apache webserver, this is often accomplished with a .htaccess file in
  those directories.

• Deny access to temporary files, see $cfg['TempDir'] (if that
  is placed inside your web root, see also Web server upload/save/import directories.

• It is generally a good idea to protect a public phpMyAdmin installation
  against access by robots as they usually can not do anything good there. You
  can do this using robots.txt file in the root of your webserver or limit
  access by web server configuration, see 1.42 How can I prevent robots from accessing phpMyAdmin?.

• In case you don’t want all MySQL users to be able to access
  phpMyAdmin, you can use $cfg['Servers'][$i]['AllowDeny']['rules'] to limit them
  or $cfg['Servers'][$i]['AllowRoot'] to deny root user access.

• Enable Two-factor authentication for your account.

• Consider hiding phpMyAdmin behind an authentication proxy, so that
  users need to authenticate prior to providing MySQL credentials
  to phpMyAdmin. You can achieve this by configuring your web server to request
  HTTP authentication. For example in Apache this can be done with:

  AuthType Basic
  AuthName "Restricted Access"
  AuthUserFile /usr/share/phpmyadmin/passwd
  Require valid-user
  

  Once you have changed the configuration, you need to create a list of users which
  can authenticate. This can be done using the htpasswd utility:

  htpasswd -c /usr/share/phpmyadmin/passwd username
  

• If you are afraid of automated attacks, enabling Captcha by
  $cfg['CaptchaLoginPublicKey'] and
  $cfg['CaptchaLoginPrivateKey'] might be an option.

• Failed login attempts are logged to syslog (if available, see
  $cfg['AuthLog']). This can allow using a tool such as
  fail2ban to block brute-force attempts. Note that the log file used by syslog
  is not the same as the Apache error or access log files.

• In case you’re running phpMyAdmin together with other PHP applications, it is
  generally advised to use separate session storage for phpMyAdmin to avoid
  possible session-based attacks against it. You can use
  $cfg['SessionSavePath'] to achieve this.

Using SSL for connection to database server¶

It is recommended to use SSL when connecting to remote database server. There
are several configuration options involved in the SSL setup:

$cfg['Servers'][$i]['ssl']

Defines whether to use SSL at all. If you enable only this, the connection
will be encrypted, but there is not authentication of the connection – you
can not verify that you are talking to the right server.

$cfg['Servers'][$i]['ssl_key'] and $cfg['Servers'][$i]['ssl_cert']

This is used for authentication of client to the server.

$cfg['Servers'][$i]['ssl_ca'] and $cfg['Servers'][$i]['ssl_ca_path']

The certificate authorities you trust for server certificates.
This is used to ensure that you are talking to a trusted server.

$cfg['Servers'][$i]['ssl_verify']

This configuration disables server certificate verification. Use with
caution.

When the database server is using a local connection or private network and SSL can not be configured
you can use $cfg['MysqlSslWarningSafeHosts'] to explicitly list the hostnames that are considered secure.