← CodeClarityLab Home
Browse by Category
+ added · updated 7d
← Back to glossary

MySQL DSN (Data Source Name)

php PHP 5.1+ Beginner

Also Known As

PDO DSN database connection string PHP mysql DSN format

TL;DR

The connection string passed to PDO specifying the database driver, host, port, database name, and charset.

Explanation

A MySQL DSN follows the format: mysql:host=hostname;port=3306;dbname=database;charset=utf8mb4. The charset parameter ensures the connection uses the correct encoding from the first packet. Omitting charset and using SET NAMES afterwards can cause a brief window where the wrong charset is active. Unix socket connections use unix_socket=/path/to/mysql.sock instead of host. The DSN does not include credentials — those are passed as separate constructor arguments.

Watch Out

Omitting charset from the DSN and using SET NAMES afterwards leaves a window where the wrong charset is active for the first query.

Common Misconception

SET NAMES 'utf8mb4' after connecting is equivalent to charset=utf8mb4 in the DSN. SET NAMES is a workaround — charset in the DSN sets encoding at the protocol level before any queries run.

Why It Matters

A malformed DSN causes a cryptic connection error. Missing charset causes encoding bugs. Using the wrong host/port in different environments causes environment-specific failures.

Common Mistakes

  • Omitting charset from the DSN and relying on SET NAMES — encoding mismatch before SET NAMES executes.
  • Hardcoding host/port in the DSN instead of reading from environment variables.
  • Including the password in the DSN string instead of the constructor's second and third arguments.

Avoid When

  • Never include credentials in the DSN string — pass them as the second and third PDO constructor arguments.
  • Do not hardcode DSN values — use environment variables for all connection parameters.

When To Use

  • Build the DSN from environment variables — never hardcode host, port, or database name.
  • Always include charset=utf8mb4 in the DSN string.

Code Examples

✗ Vulnerable
// Hardcoded, no charset, credentials in DSN string
$pdo = new PDO('mysql:host=localhost;dbname=mydb;user=root;password=secret');
✓ Fixed
// Build DSN from environment
$dsn = sprintf(
    'mysql:host=%s;port=%d;dbname=%s;charset=utf8mb4',
    $_ENV['DB_HOST'],
    (int) ($_ENV['DB_PORT'] ?? 3306),
    $_ENV['DB_NAME']
);
$pdo = new PDO($dsn, $_ENV['DB_USER'], $_ENV['DB_PASS']);

Added 31 Mar 2026
Views 16
Rate this term
No ratings yet
🤖 AI Guestbook educational data only
| |
Last 30 days
0 pings W 0 pings T 0 pings F 1 ping S 0 pings S 0 pings M 0 pings T 0 pings W 0 pings T 0 pings F 0 pings S 1 ping S 0 pings M 0 pings T 0 pings W 0 pings T 0 pings F 0 pings S 0 pings S 0 pings M 0 pings T 0 pings W 2 pings T 0 pings F 0 pings S 0 pings S 0 pings M 0 pings T 0 pings W 0 pings T
No pings yet today
No pings yesterday
Unknown AI 3 Google 2 Perplexity 1 Meta AI 1 Ahrefs 1
crawler 6 crawler_json 1 pre-tracking 1
DEV INTEL Tools & Severity
⚙ Fix effort: Low
⚡ Quick Fix
Always include charset=utf8mb4 in the DSN — do not rely on SET NAMES after connection
📦 Applies To
PHP 5.1+ web cli
🔗 Prerequisites
PDO
🔍 Detection Hints
new PDO('mysql:...password=...') or charset not in DSN
Auto-detectable: ✓ Yes semgrep
⚠ Related Problems
🤖 AI Agent
Confidence: High False Positives: Low ✗ Manual fix Fix: Low Context: Line
CWE-798

✓ schema.org compliant