Next DB

Install the package, then go to Components > Next DB > Dashboard. The first time you open it, the editor connects to your Joomla database automatically — no setup required. From there you can attach additional databases under Connections.

No. Super Users see every connection and every operation out of the box. Restricting access happens on the Profiles page — create a profile, scope it, then assign it to a Joomla user or user-group.

No — and that is deliberate. Next DB write-protects Joomla's auth, access and extension tables (#__users, #__usergroups, #__assets, #__extensions and the like) on the Joomla database. You can browse and read them, but mutations are refused for everyone, Super Users included — corrupting those tables would break the whole site. Ordinary content and component tables stay fully editable. On an attached external connection this core-table protection is opt-in per connection, so you can turn it off where you genuinely need to edit such tables.

No. Next DB ships its own DB abstraction (Doctrine DBAL) and runs every read and write through Joomla's own PHP runtime. The only requirement is that your Joomla site is up and reachable.

Through an always-on PHP gate. The service layer evaluates the active user's profile permissions before running any operation — that gates every path, including the SQL console — and core-table protection (CoreTableGuard) blocks mutations of Joomla's own auth/access/extension tables. A per-connection hard enforce mode that would bind a profile's operation grants to MySQL user grants at the database level is stored on the profile but reserved for a future release — it is not applied yet.

In #__nextdb_connections as libsodium secretbox ciphertext, encrypted with a key derived from your Joomla site secret. The plain-text password is never written to disk.

Out of the box, only Super Users. But management is delegable: a profile carries a per-area, per-action management block — profiles, connections, views, settings, plus audit purge and policy — so you can let a non-Super-User create connections but not delete them, or manage views and nothing else. Granting management rights, and assigning a management-bearing profile, are themselves Super-User-only, so a delegated manager can never escalate their own privileges.

Yes. Every profile has a sql_console switch — turn it off and the SQL console is hidden in the UI, and the API endpoint refuses the request.

MySQL and MariaDB are hardened end-to-end. SQLite is verified end-to-end (browse, edit, structure rebuild, console, export/import). PostgreSQL is verified by the CI integration suite against a real server (install schema, introspect, browse, CRUD, structure, truncate and console); a few niceties like COMMENT ON and the socket-directory host form remain best-effort. MS SQL, Oracle and DB2 are reachable through DBAL but not yet hardened.

Yes. Connections > New lets you set host, port, user, password, database and driver-specific options. The connection is tested before save and stored with an encrypted password.

No. Mongo, Elasticsearch and similar engines would need separate non-DBAL drivers — out of scope for now.

Every mutation by default — inserts, updates, deletes, structure changes, imports, exports and SQL-console runs. DataService captures before/after row snapshots; other services log one summary entry per operation. Configuration changes (connection/profile/assignment save and delete) are governed by a global policy.

In #__nextdb_audit in the Joomla database. Writes are best-effort — if the audit table is unreachable, the operation still succeeds. Retention is per-row: each entry carries its own purge_after timestamp computed from the active policy.

Yes, three ways. A bundled com_scheduler task (plg_task_nextdbaudit) prunes the trail automatically on whatever schedule you set; the Audit page has a manual purge action (Super Users, or any profile granted audit purge); and viewing the log opportunistically prunes expired entries. Retention is driven by each entry's own purge_after stamp.

Joomla 4, 5 and 6 on PHP 8.1 or higher. Earlier PHP is unsupported because Doctrine DBAL 4 — the editor's backing library — requires PHP 8.1+.

Yes. Doctrine DBAL 4 is bundled under the component's libraries/vendor/ and loaded lazily. The bundle is unscoped; if another extension on the site loads an incompatible DBAL first, you may need to update it.

English (en-GB) ships out of the box. Add any language by creating standard Joomla .ini files under administrator/language/<tag>/com_nextdb.ini and com_nextdb.sys.ini.

Yes. Licensed under GNU GPL v2 or later. Sold commercially on nextsoftware.dev with priority support; the source itself is open.