Can you safely store passwords in PHP?

Question

I recently made a PHP login script with a Username and Password login for a test with sessions and no MySQL.

I stored the passwords in an array like this

$filepassword[1] = "123"; // User Bob
$filepassword[2] = "321"; // User Tim

The user names are stored the same way in an array like so

$fileuser[1] = "Bob"; // Password 123
$fileuser[2] = "Tim"; // Password 321

I use Post to get the inputtedd password and then put it in a for loop and if the password equals one in the array it breaks and returns 1 and then checks to see if the numbers match for the username and checks it for a match.

But, should Istore the passwords or even a hash of them in a php file?

Answer 1

Why would you use a php file for storage of usernames and passwords? It's pretty standard (and simple nowadays) to use a database for username / password retrieval.

That being said, you don't want to store the password in plain text in the database.

PHP 5.5 has a whole new set of password functions coming out, so how about you use a library that allows for forward compatibility of these functions? Password_compat.

The point is, you include the file, use it's functions, and then when 5.5 comes out, you just remove the include and all the functions will still work because they're part of core.

It's really simple to use:

• Hash the password using password_hash()
• Store the username and hash in the database
• When logging in, use password_verify() to verify the password sent in $_POST against the hash in the database.

That's it! Simple, secure, forward compatible. Highly recommended over flat file storage.

---

You really should take the time to learn MySQL. However, it's great to code to an interface rather than a concrete implementation and switch out one type of storage for another any time you want.

That being said, hash your passwords and usernames and, if you must, write them to a file. At least they'll be hashed, and not in plain text. You can still use the functions described above.

You can even serialize() your array and write that to a file, then unserialize() it on the way back. But I'd really recommend taking the time out to learn the basics of MySQL, you'll pick it up in no time at all.

Answer 2

Well yes and no.

PHP is a server side language so via the client no one can see the password.

BUT 1: if a hacker get access to the server your password aren't save and compromised. 2: a mistake is made and php files aren't see as php but text, so the server ouputs the PHP as text, again compromised

So in a meaning is it highly recommend to hash them atleast to be secure.

Then is the question of saving it in a php file. It has some problems. 1: not easy in use, with a database you can make nice searches etc 2: you load a (in time) huge array in php for only 1 value needed. Waste of memory

Answer 3

For a small number of passwords, storing them in a file is perfectly feasible. You should just choose a sane array format, yours is... quite suboptimal. Also, as has been said, never store passwords in plaintext.

passwords.php

<?php

return array(
    'Bob' => '$2y$10$lwnevwevweuvuev...',  // hash of Bob's password
    ...
);

login.php

<?php

// include https://github.com/ircmaxell/password_compat functions
require_once 'lib/password.php';

$passwords = require 'passwords.php';

if (isset($_POST['username'], $_POST['password'])) {
    if (!isset($passwords[$_POST['username']])) {
        die('Invalid username');
    }
    if (!password_verify($_POST['password'], $passwords[$_POST['username']])) {
        die('Invalid password');
    }
    echo 'Hi there!';
}

As long as you store the passwords properly hashed using a robust algorithm, storing them in a file is hardly any more insecure than using a database. With the caveat that you should be really careful never to accidentally reveal the contents of that PHP file; a misplaced var_debug($passwords) or a misconfigured web server may make the password hashes publicly visible. In this case they're still hashed, but it's still better to keep them secret. Use a proven and user friendly library for hashing, like https://github.com/ircmaxell/password_compat.

Answer 4

I think the most safe option is to use the md5() function. $fileuser[1] = md5($fileuser[1]); etc...

Convert everything to md5 and then you can compare the converted strings to each other for equality or unequality.

Hope i have helped.