有没有办法为php mysqli登录存储哈希密码？

Question

I usually do

$password = "password";
$mysqli = new mysqli("localhost", "root", $password, "database");

Is there a way to give mysqli a hashed password instead of having to save the plaintext form stored in my script? Is there a good practice to avoid having plaintext passwords around my script? Is this safe

I get it won't be 100% proof but it does make it slightly more cumbersome to not have the plaintext available?

Answer 1

Nope; that would defy the point in using password hashing in the first place. If you could log in with the hashed password, then the hashed password would essentially be your password.

You could encrypt it, but the key for decryption would also have to be stored somewhere, so you'd merely be obfuscating the password, not protecting it. Anyone who wants it can easily find it, if he has access to your script files.

Ultimately, you'll have to place some trust in the security of your server's own filesystem. Your best bet is just to make sure it's stored outside the document root and is not readable by any user/group on the server who doesn't need to read it.

Answer 2

Unfortunately, no. Whatever is sent as the password is the password. Even if you were to create a small function to hash your password, you'd still have to have the password in plain text. Even still, that hashed password becomes your password (as you would've setup in MySQL) therefor it's still plain text.

Since PHP is a server-side script no one can see this password nor is it ever transferred to the client so it cannot be intercepted. I'd recommend a hard to guess password and make sure your scripts are protected from MySQL injection so no one can access your database through that route.