PHP文件将密码存储为文本文件

Question

For my very small website that only friends know of, I am developing a password system. I am saving the passwords in a php file like this.

<?php
if($_GET["p"]=="password"){
?>
user1 password1
user2 password2
<?php
}
?>

Then, I can read the password with file_get_contents(pass.php?p="password"); And I can still write the password by writing to the php file just like I would a text file. Is this method insecure? Are there similar methods that are that do not require a database? I don't think my site needs encryption, it wouldn't hurt too much if the passwords were compromised.

Answer 1

Whoa. I would say it's quite insecure. Is there a reason why for not using a database?

Also alternatively, to make it more secure without a database if you wish, you could create a combination of username+password with md5 and/or sha1 encode and save it as an extensionless file in a directory, and compare if the combination is right with file_exists

Answer 2

Check out the site http://www.hackthissite.org It allows you to do real life examples of how people hack websites. One of the basic missions is learning to get passwords from an included text file. If anyone figures out the whereabouts of the text file. Hidden files can be found easily, then they will have access to all of your passwords. It's up to you, you might as well not even have a login system if you don't care about security. If you do care though, just get mysql, it's free and it's not hard to use.

Answer 3

These are few suggestion for improving your current method.

• you can make direct access to this file is restricted, using apache rewrite module as I remember.

• Use a complex password (phrase with special chars and nums) as the main password use for the page access.

• For the main password also, compare the md5 or sha1 hash value of the password and the md5 and sha1 hash value of the value of GET variable instead of putting plain text there.

• Store md5 or sha1 hashes of the passwords instead of storing plain text password. then when comparing the passwords, you can convert the user entered value to the hash of that value and compare it with the stored one.

• When hashing, you can use a seed for that as I remember, which will increase the security little bit more.

This will make it little bit more secure, because if someone logged to the server, he cannot directly get the password text of your users. But please be aware that most of the hash values can be broken using a rain bow table. But this is at least more secure than storing a plain text password.

But I still prefer if you can store your data in a database instead of a file like this.

Answer 4

It doesn't matter whether you store the passwords in a file or in a database, the same measures should be taken. Do not store the plaintext password there, instead store only the hash-value of the password. So even if somebody can read the file, he doesn't know the passwords. As a side effect, it will also avoid encoding problems with special characters.

Use a slow key-derivation function like BCrypt to hash the passwords. Fast hash functions like MD5 or SHA-512 are not appropriate for hashing passwords, simply because an attacker can brute-force them ways too fast (about 8 Giga MD5 values per second with common hardware).

PHP soon offers two simple functions password_hash() and password_verify() to generate such BCrypt values. There also exists functions for older PHP versions, have a look at this answer .