I use a shell script run as a cron job to back up this database and the Hype database. To do this the scripts needed the correct passwords to get to the data. In an ideal world I might have set up an account with select-only access, but it’s a shared server and I only have one account per database. I was specifying the username and password for MySQL on the command line and anyone else could see it with a simple ps.

The much better way is to create a defaults configuration file. MySQL cnf files can consist of any option specified as a command line argument. They are organised by application, e.g.

[client]
user=myname
password=mypassword
host=mysql.com

The password option has exactly the same effect of putting --password=mypassword on the command line to the MySQL client. You can have sections for mysqld, mysqldump and so on.

By default the MySQL apps will look in several files for these kinds of settings. However, you can point it to a particular file with --default-extras-file. This loads your file after the global defaults. I use this to point mysqldump at two different databases.