5 replies to this topic

[simon777]

hi guys
is it safe to save some secret information in a php file like this ??!!

<? /*
my secret
my secret
my secret
*/ ?>

i want to use it for the passwords of my users instead of sql.
what do u think?

[NGPixel]

Well, yes it is but it's definitely not a good way to store passwords, quite unusual as well...

SQL is the best method to store passwords. Otherwise use a flat-file that is stored below your public folder so it cannot be accessed.

You shouldn't store passwords in comments imo, as I don't see how you're going to access them?

[simon777]

NGPixel, on Oct 1 2007, 02:13 PM, said:

You shouldn't store passwords in comments imo, as I don't see how you're going to access them?

it's simple
for example
if ($_post['pass'] == file('user/file.php')[1]) { u are logged in }

tnx 4 ur answer

[(old-account)]

Unless something goes wrong on the server or you get very clumbsy with other php/htaccess files then its virtually 100% secure.

The only way it becomes insecure is if you mess something else up or have a bad web host .

[austen]

This is NOT a secure way to store passwords. Learn to use SQL. You could in theory use htaccess to hide this file from users but it could still be guessable and accessed in that way. Also, in terms of being efficient php files aren't supposed to be their own database, if you had a lot of users this wouldn't work all that well..

I guess in the end the choice is yours but I would highly recommend NOT going this route.

-austen

[dEcade]

I've never saw it done like this. I think it would be better to use SQL because if some one got a hold of that file you would be in trouble. It is easier to get a file than something in SQL.

dEcade