Installing phpMyAdmin - Mastering phpMyAdmin 2.11 for Effective MySQL Management - page 34

In this case, all deny rules will be applied first, followed by allow rules. If a case is
not mentioned in the rules, access is granted. Being more restrictive, we'd want to
deny by default. We can use:
$cfg['Servers'][$i]['AllowDeny']['order'] = ' allow,deny ';
This time, all allow rules are applied first, followed by deny rules. If a case is not
mentioned in the rules, access is denied.
The third (and most restrictive) way of specifying rules order is:
$cfg['Servers'][$i]['AllowDeny']['order'] = ' explicit ';
deny rules are applied before allow rules, but to be accepted, a username/IP address
must be listed in the allow rules and not in the deny rules.
Simplified Rule for Root Access
Since the root user is present in almost all MySQL installations, it's often the target
of attacks. Starting with phpMyAdmin 2.6.1, a parameter permits us to easily block
all logins of the MySQL's root account, using the following:
$cfg['Servers'][$i]['AllowRoot'] = FALSE;
Restricting the List of Databases
Sometimes it is useful to avoid showing in the left panel all the databases to which a
user has access. phpMyAdmin offers two ways of restricting: only_db and hide_db .
To specify the list of what can be seen, the only_db parameter is used. It may contain
a database name or a list of database names. Only these databases will be seen in the
left panel:
$cfg['Servers'][$i]['only_db'] = 'payroll';
$cfg['Servers'][$i]['only_db'] = array('payroll', 'hr);
The database names can contain MySQL wildcard characters like _ and % .
We can also indicate which database names must be hidden with the hide_db
parameter. It contains a regular expression ( http://en.wikipedia.org/wiki/
Regular_expression ) representing what to exclude. If we do not want users to see
all databases whose names begin with secret we would use:
$cfg['Servers'][$i]['hide_db'] = '^secret';
These parameters apply to all users for this server-specific configuration.