DEV Community: Thierry Feuzeu

What if we improve the way developers are given access to databases

Thierry Feuzeu — Fri, 03 Oct 2025 18:00:41 +0000

Developers often need direct access to the databases used by the applications they work on, in virtually every environment of a project: development, testing, pre-production, and sometimes even in production.

To do this, they use software such as Adminer, PhpMyAdmin, DBeaver, and many others, which share a common feature: they authenticate their users with database access parameters.
This pushes teams within companies to share database access credentials with developers, which, in the best-case scenario, is done with a password manager software.

This sharing of database credentials can pose several risks.
Accidental leaks of sensitive information, if a developer inadvertently shares this data with third parties.
Reuse of credentials in inappropriate environments.
Uncontrolled and untraceable access, due to the sharing of this information with multiple developers.
Access by unauthorized individuals, when developers leave the company.

Enforcing good security practices under these conditions will be difficult.

Jaxon DbAdmin

Jaxon DbAdmin is a web-based database management application that takes a different approach to user authentication and database connection.

The application clearly separates the authentication of its users and the connections to databases. The parameters of the later are stored only in its configuration file on the server.

When a user logs in, Jaxon DbAdmin reads the list of databases they have access to from its configuration and presents it to them.
And when the user performs an action on a database, Jaxon DbAdmin reads the corresponding database credentials from its configuration, executes the action, and returns the result.
This allows the user to access the database contents without having access to the database credentials.

It's worth noting that this database access technique isn't exactly new.
On the one hand, applications that use databases already store database credentials this way, and on the other, there are already database management applications that authenticate their users elsewhere than in the database.
Jaxon DbAdmin combines these two approaches to make it its default mode.

Jaxon DbAdmin is an open source software distributed under the BSD-3-Clause license: https://github.com/lagdo/dbadmin-app.
A Docker image is also provided: https://hub.docker.com/r/lagdo/jaxon-dbadmin.

Jaxon DbAdmin is still actively developed, and some features are not yet available.

The advantages

Storing database credentials on the server only enhances security.
Developers cannot copy, transfer, or expose credentials, even by mistake.
Each request can be linked to a specific user or role, making it easy to audit who did what, and when.
Login credentials are no longer scattered across development workstations, in configuration files, emails, or other communication tools. They can even be secured in a vault.

Connection configuration is now managed at the platform or infrastructure level, not in the application code. This makes it easier to manage environments (dev, staging, production).
Since users don't have access to the database credentials, they can be changed regularly without disrupting applications or developers.
Similarly, if the credentials are compromised, the administrator won't have to change them on developer workstations. This is done in a single location, transparently for applications and users.

There will also be better permission management based on the principle of least privilege: each user only has access to what he needs, regardless of the database credentials actually used.
If a developer leaves, his access to the application can simply be revoked, without having to change the database password and impact all other applications and users.

Finally, many security standards require strict data access management.
Not sharing database credentials makes it easier to comply with these requirements.

The challenges

Despite the above advantages, the use of existing tools that offer separate authentication is not common enough because it faces several challenges.

Setting up and using a secrets management system (vault) or an API Gateway with the necessary permissions is complex. For a small team or on certain projects, this represents a significant overhead in terms of time, skills, and budget.
On the other hand, tools such as DBeaver (Community) and Adminer are free and open-source.

Certain complex tasks (analyzing indexes, optimizing queries, performing large-scale exports/imports) are much simpler with a graphical tool than with a command line or REST API.
The same is true for analyzing the structure of a complex database with many tables.
The user-friendliness of the graphical interface of tools like DBeaver or Adminer is a definite advantage.

Experienced developers sometimes like to have direct control over the database.
They appreciate the speed of an ad hoc SQL query to explore a database schema, understand relationships between tables, or test complex logic before writing it in code.
For occasional manipulations, connecting with a graphical tool seems faster.

It is difficult to replicate an environment where direct access to the database is prohibited on a development workstation.
Developers then need a local database to code on, and in this case, access security isn't a priority.
Adminer or DBeaver are ideal for this, and the temptation is great to use the same tool for all environments.

Many developers have always worked with direct database access.
In many companies, sharing database access credentials is a historical and culturally entrenched practice. Changing this requires shifting processes and mindsets.
Furthermore, not all developers are aware of the risks or alternative best practices.

In conclusion

Jaxon DbAdmin is a web-based database management application that separates user authentication and database connections, meaning that database credentials are not shared with users accessing them.
Its configuration allows the administrator to define credentials for each user or group of users.

It will therefore improve the security of access to databases, while maintaining the user-friendliness and simplicity of a graphical interface.

Its code comes from Adminer, which has been refactored and modernized. Although its UI has also been modernized, it offers similar functions as Adminer.

However, Jaxon DbAdmin is still actively developed, and some features are not yet available.

Announcing Jaxon version 5

Thierry Feuzeu — Thu, 25 Sep 2025 17:44:56 +0000

This post was originally published on the Jaxon blog.

After more than two years of development, the version 5 of the Jaxon library is finally out!

This release is an important step that I think will bring the Jaxon library to the next level, because it implements the features I hoped the library had when I started developing and using it more than ten years ago.

So what's new in this release?

Exported PHP classes are now called components, and they can be of three different types. Some components can be attached to DOM nodes, and used to set their content.
The call factories in PHP have been enriched, and now support calls to Javascript functions and event handlers, as well as their parameters.
The command names and formats in responses are now more meaningful, and their processing in Javascript is improved. Deprecated commands have also been removed.
The dialog libraries now contain only Javascript code, in a single and tiny object. They will therefore be much easier to create and maintain.

Now let's dive more in depth into each of these new features.

The Jaxon components

In the previous versions of Jaxon, the webpage content was set exclusively using the HTML id attribute.

$this->response->html('dom-element-id', $text);

Each DOM element with dynamic content in a webpage content needed to be given a unique id, which will then be used to update its content. Keeping track of all those ids in an application was not an easy task.

Jaxon 5 introduces a new UI component, which is a Jaxon class that defines the content of a DOM element.
It just needs to implement a method named html(),

namespace Jaxon\Demo\Calc\App;

class Calc extends \Jaxon\App\NodeComponent
{
    public function html(): \Stringable
    {
        return $this->view()->render('jaxon::demo::calc::calc');
    }
}

and to be bound to a DOM element in a webpage.

<div <?= attr()->bind(rq(Jaxon\Demo\Calc\App\Calc::class)) ?>>
</div>

The render() method in the component can then be used to set the DOM element content, for example with an event handler.

    <button type="button" class="btn btn-primary" <?=
        attr()->click(rq(Jaxon\Demo\Calc\App\Calc::class)->render()) ?>>Clear</button>

In this example, a click on the button will display the jaxon::demo::calc::calc view in the div element the UI component is bound to.

The new components now make it very easy to build complex UI with Jaxon.

The call and selector factories

Since one of the core features of Jaxon is to write UI components code in PHP on the server, it is important to be able to make calls to Javascript functions, define event handlers, and last but not the least, pass the contents of the webpage as parameters to those calls.
That's the role of the call factories.

The call factories have been around since the version 2, initially as the JQuery PHP API.
They have evolved a lot since then, and now they can make calls to the exported Jaxon classes, or to any Javascript function or object.
They can also define event handlers on the webpage elements using Javascript or JQuery-style selectors.
Thirdly, they also provides functions to pass any content of the webpage as parameter to Javascript calls.

In this code from the Jaxon examples, JQuery selectors are used in a Jaxon custom HTML attribute to define calls to Jaxon classes as event handlers on two select lists, and to pass the selected item value as parameter to the handler.

    <div class="row" <?= attr()
        ->select('.app-color-choice')
            ->on('change', rq(AppTest::class)->setColor(jq()->val()))
        ->select('.ext-color-choice')
            ->on('change', rq(ExtTest::class)->setColor(jq()->val())) ?>>

In this other example, a command is added in a response to make a call to the Tontine.makeTableResponsive('content-planning-charge-page') Javascript code in the browser.

    $this->response->jo('Tontine')
        ->makeTableResponsive('content-planning-charge-page');

When building an application UI on the server, being able to make Javascript calls and set event handlers in a webpage is paramount, and the call factories provide Jaxon with a powerful set of features to achieve that quite easily.

Javascript library rewrite

The Javascript library rewrite started as a discusion on Github about the forbidden usage of the eval function.

I then decided to rewrite the Javascript library, which today has resulted in many important changes.

The library now includes a command processor which executes existing Javascript functions from a JSON payload. With this processor, there's no need for the eval function anymore, and it is also at the foundation of the call factories described above.

The library also includes an attribute processor, which handles the Jaxon custom attributes needed to implement the UI components bindings and the event handlers.
In the example above where the Jaxon\Demo\Calc\App\Calc UI Component is bound to a div element, the following HTML code is actually generated.

<div jxn-bind="Jaxon.Demo.Calc.App.Calc">
...
</div>

The response commands were also rewritten with new names and a new JSON format. Their names are now more meaningful, and the obsolete ones were removed.

The Dialog plugin

The Dialog plugin is a special case in the Jaxon universe. It is a Jaxon response plugin, but at the same time it can also be extended with it own plugins.

In the previous version, adding a dialog plugin required to write functions in both PHP and Javascript.
In the v5 release, only a tiny Javascript object is now necessary.

This is for example the code of the Notify library integration, which implements the alert function.

jaxon.dom.ready(() => jaxon.dialog.register('notify', (self, options) => {
    // Dialogs options
    const {
        alert: alertOptions = {},
    } = options;

    const xTypes = {
        success: 'success',
        info: 'info',
        warning: 'warn',
        error: 'error',
    };

    /**
     * Show an alert message
     *
     * @param {object} alert The alert parameters
     * @param {string} alert.type The alert type
     * @param {string} alert.message The alert message
     *
     * @returns {void}
     */
    self.alert = ({ type, message }) => {
        $.notify(message, {
            ...alertOptions,
            className: xTypes[type] ?? xTypes.info,
            position: "top center",
        });
    };
}));

The only feature in PHP classes is to load the Javascript files into the webpage.

The examples

A new example is introduced to illustrate the Jaxon operation.

The example now implements a simple calculator, which takes an operation and two operands as parameters, performs the calculation using an injected service, and displays the result.
There are two text zones and a select combo for the inputs, and the result is displayed in a readonly text zone.

The example is built with the new Jaxon UI components, and also released as a Jaxon package.
This package is used in the Laravel, Symfony and Slim Framework demo applications, to show how the Jaxon library can be used to build a cross-framework and full-featured package including both the frontend and backend features.

The DB Admin package and the African Tontine application are also upgraded to Jaxon 5.
Although the former is still a work in progress, both are real world examples of building complex one page Ajax applications with Jaxon.

Conclusion

The new Jaxon 5 release is packed with features that make it a good choice for creating complex Ajax applications with PHP on the server side.
There are UI components to build the webpage, custom attributes to enrich the HTML code, and powerful call factories to make calls to all kind of Javascript functions in PHP.

In addition to the documentation, there are many examples in PHP or with framework integration, and real world open source applications using the library.