如何在没有数据库的情况下存储密码（PHP）？

Question

I would like to have a page that requires a password to login, but without a dataabase.

I was thinking of having it hard coded in the page, ie:

$password = "something"

Or encrypt it and store it in a text file?

Any advice is appreciated.

Answer 1

You could use PHP's md5 encryption libraries to encrypt the password and then store it in the text file. Since md5 isn't reversible, the password would be secure.

You definitely do not want to store in plain text.

You could also store the password in the PHP file, but using the encrypted hash. The advantage of the file is that the data is separated from the business logic, which can make adding a database or the ability to use multiple users/passwords slightly easier.

UPDATE : If you store the password in plain text in the PHP script unencrypted, anyone who hacks your server or has access to the server can read the contents of your plain-text PHP files.

Answer 2

If it is not going to be in a database, I'd be inclined to store it in a text file that is outside of the servers webroot. If you store it in the php script, and something happens to the server configuration, it is possible the php script could be served up in plain text, rather than being parsed through php, so the password would be visible. Granted, under normal circumstances, this would not be very likely to happen, but it is a possible risk. Encrypting it may help, but you'll also have to have the decryption key stored someplace, so it would only be a slight inconvenience for someone to decrypt it. It might be better to store the password in hashed format (eg MD5 or SHA-1), hash the password the user enters using the same method, and then compare the hashes.

Answer 3

You can do either of those. Just be sure to store a hash of the password, not the real one for security. Here's and extremely simple example.

<?
    if(md5($_REQUEST['password']) == 'md5ofyourpasswordHERE'){
         //do your logged in page stuff here.
    } else {
         //kick them out or tell them to resupply password.
    }
?>

You can also check the username, if that's important to you.

Hope that helps!

Answer 4

if you want to store in text file or hardcoded in php script I will recomended to hash it

• first echo sha1('your password');
• result string (not readeable) copy and paste in script or text file
• when compare use if ( sha1($password) == '543f3fc32c232c32') ...

you can use also md5 for hashing

Both methods are one way encripting so "make sure you will remember your password"