HTTP tunnel

Shared hosting (cPanel and similar) often gives you neither SSH access nor an open database port. The database only accepts connections from the web server itself. The HTTP tunnel gets you in anyway: you upload a small PHP script that NabuSQL generates, and NabuSQL sends your work to that script, which runs it on the server.

The tunnel is available for MariaDB connections. The web server needs PHP 7.4 or newer (PHP 8.x recommended) with the mysqli and openssl extensions, which virtually every host has.

Try Remote MySQL first

If your host lets you allow your IP address under Remote MySQL in cPanel, a direct connection is simpler and faster. Use the tunnel when it does not, or when port 3306 stays closed anyway.

How it works and why it is safe

• One script per connection. When you download the script, NabuSQL generates a random 256-bit key and writes it into the file. The same key is stored with the connection, encrypted like your passwords.
• Everything is encrypted. Every request and every response — the database user name and password, your queries, the results — is encrypted with AES-256-GCM using that key. Use an https:// address anyway; it also hides which script you are talking to.
• No key, no access. A request that was not encrypted with the right key gets a plain 404 Not Found, so the script cannot even be told apart from a missing page. A recorded request cannot be replayed later.
• The script stores no data. It keeps only the key. Your database password travels inside the encrypted request each time and is never written to the server.
• Nothing goes through us. NabuSQL talks directly to the script on your server.

Setting it up

1. Create a new connection and choose MariaDB.
2. On the Basic tab, enter the database as the script sees it on the server:
   • Host: localhost
   • Port: 3306
   • User, Password and Database: the full names from cPanel, including the account prefix (for example myacct_app and myacct_db).
3. Open the HTTP Tunnel tab and tick Use HTTP tunnel. From now on this connection works only through the tunnel; the SSH tunnel is switched off.
4. Optionally set the PHP limits.
5. Click Download PHP script and save the file (nabu_xxxxxxxx.php).
6. Upload the file to your web server with the hosting's File Manager or FTP, for example into public_html.
7. Enter the script's address in Script URL, for example https://example.com/nabu_xxxxxxxx.php.
8. Click Check script. It shows the PHP version, whether mysqli and openssl are present, and the host's limits.
9. Click Test connection, then Save.

Opening the script in a browser shows "Not Found"

That is intended. Without the key the script answers every request with a 404.

PHP limits

Two PHP settings can be raised from the script itself. Leave them empty to keep the host's defaults.

Setting	Meaning
max_execution_time	Seconds one request may run. 0 removes the PHP limit
memory_limit	Memory one request may use, for example 256M. -1 removes the limit

Some hosts do not allow higher values. Check script always shows the values that are actually in effect and warns when the host refused what you asked for. Even without a PHP limit, the web server ends a request after a few minutes, so "unlimited" is never truly unlimited.

post_max_size (the largest request the server accepts) cannot be set from a script. Change it in cPanel under MultiPHP INI Editor if you need it. NabuSQL reads it and sizes its requests to fit.

After changing a limit, download the script again and replace the file on the server.

What works through the tunnel

Almost everything you do with a direct connection:

• browsing databases, tables, views, routines, triggers and sequences;
• the data grid with filtering, sorting and editing, BLOB viewer and column statistics;
• the SQL editor, EXPLAIN and the query profiler;
• the structure editor (columns, indexes, keys, triggers);
• backup, restore, Execute SQL file, Dump SQL file and sample dumps;
• export and import (CSV, Excel and others);
• Data Transfer — from and to a tunnel connection, and between two tunnel connections;
• structure and data compare, data search, maintenance (CHECK, OPTIMIZE, REPAIR, ANALYZE);
• database properties, renaming databases and tables, row history, the process list.

Not available through the tunnel:

• user management and privileges — on shared hosting these are managed in cPanel;
• Task Scheduler and creating a database from XML/JSON;
• stopping a running query;
• the transaction option in Execute SQL file and Data Transfer: every tunnel request is a separate database session, so one transaction cannot span them. Statements run in batches, each committed as it completes.

Items that are not available are greyed out in the menus.

Large results

One request may use only as much memory and time as the host allows, so NabuSQL never asks for more than fits:

• the data grid reads one page at a time, as always;
• a SQL editor query with a very large result is cut off at a safe point, and the result bar says Result cut off — add a LIMIT or a narrower WHERE;
• backup, export and Data Transfer read big tables in smaller pages. A page that does not fit is read again at half the size; a backup is never silently incomplete;
• restore and import send statements in batches sized to the host's post_max_size and memory_limit.

Updating the script

New versions of NabuSQL sometimes need a newer script. You will then see The tunnel script on the server is outdated. Click Download PHP script again — the key stays the same — and replace the file on the server.

Troubleshooting

Message	What to do
Endpoint returned 404 on Check script	Wrong address, or the file on the server belongs to another connection. Check the URL, then download the script again and replace the file.
Access denied for user …	User name, password or database on the Basic tab. Use the full cPanel names with the prefix; the host stays localhost.
Access denied … to database 'information_schema'	You picked a system database as the target. Choose your own database.
Allowed memory size … exhausted	The host's memory_limit is too small for that operation. Raise it in the PHP limits or in cPanel.
HTTP 500	The script failed on the server, usually on memory or time. The host's error log has the details.
HTTP 403	A firewall on the host (for example ModSecurity) blocked the request. Ask the host to allow the script's address.
The tunnel script … is outdated	See Updating the script.
Not available over the HTTP tunnel yet	The function is not supported through the tunnel — see the list.
Renaming or creating a database fails	On cPanel the database user usually may not create databases. Create them in cPanel.

When you stop using the tunnel, delete the script from your server.