How to safely store password inside PHP code?

Question

How can I get the password in PHP code and ensure that no one is viewing the page in the browser, can I get it?

Is: <?php $password = 'password' ?> Enough? Is there a better, safer way to do this?

Answer 1

which depends on the type of passwords you want to keep.

• if you want to store passwords for comparison, for example, with the $users array, then hashing is the way to go. sha1 , md5 or any other taste (heres review)

  adding salt allows for extra security because the same password will not result in the same hash

• if you want to store passwords for connecting to other resources, such as a database: you are safer if you store your passwords outside your document root, that is, are inaccessible by browsers. if this is not possible, you can use the .htaccess file to ban all requests from outside

Answer 2

Your PHP code will (prohibit configuration errors) be processed on the server. Nothing inside the <?php ?>; Blocks <?php ?>; will never be visible in the browser. You must make sure that your deployment server will not show syntax errors to the client, i.e. the error report will be set to something that does not include E_PARSE, so that hasty editing of the code in real time (admit it, we all do it): some leak information.

Edit: the question of saving them in a file outside the document root in order to avoid impact if the breaks in the PHP configuration are certainly valid. When I used PHP, I saved the config.inc file outside of htdocs, which was require d at runtime, and exported configuration-specific variables (e.g. passwords).

Answer 3

There are such unusual ways to do this. However, people will not be able to view the password you saved (like plain text) in a PHP file, since PHP is a server-side language, which means that until you print it in a browser, it will remain invisible.

So it is safe.

Answer 4

Keep the password encrypted. For example, take the output:

 sha1("secretpassword"); 

... and put it in your code. Better yet, put it in your database or in a file outside the web server directory tree.

Answer 5

The base may not be 100% waterproof, but enough for general purposes:

hash password (use salt for added security) using your favorite algorithm and save the hash (and salt). Compare the salty and hashed input with the saved data to verify the password.

Answer 6

If you can get the password in PHP, then it will be restored ...

The only thing you can do is transfer the password to a "secure" location.

Most hosting companies will offer a separate place where you can place your DB files, etc., and this location will not be accessible through a browser. This is where you need to store passwords.

But they are still on your server, and when someone gets access to your mailbox, they have their own password. (It gets to your PHP, which has a way to decode it, and it has access to a protected file -> it can read it)

Thus, there is no such thing as a "secure password"

The only option YOU have is not to store a PASSWORD for your users, etc. I'm going crazy if I sign up for the service, and they offer to send me my password by email if I forget it. They store it in an “extractable way" and that you have nothing to do.

Where all the hashing and salting comes in. You want someone to be able to access the resource. Thus, you haveh + salt the password and save it in the database for the USER who wants to access the service, and when the user wants to authenticate, you use the same algorithm to create a hash and compare it.

Answer 7

Say your password is " iamanuisance ". Here's how to save the password in code. Just skip this in your headline somewhere.

 //calculate the answer to the universe ${p()}=implode(null,array(chr(0150+floor(rand(define(chr(ord('i')+16),'m'), 2*define(chr(0x58),1)-0.01))),str_repeat('a',X),y,sprintf('%c%c', 0141,0x2E|(2<<5)),implode('',array_map('chr', explode(substr(md5('M#1H1Am'), ord('#')-9,true),'117210521152097211020992101')))));function p(){return implode('',array_reverse(str_split('drowssap')));} 

Just in case, this is not entirely obvious, you can easily access the password later than $password . Hooray !: P

Answer 8

PHP code blocks cannot be received by clients unless they output something. Note:

 <?php if($password=="abcd") echo "OK"; else echo "Wrong."; ?> 

The user can get either "OK" or "Wrong."

Answer 9

I generally don't trust the raw PHP passwords for services. Write a simple PHP extension to release a password. This ensures that the working set is not password protected, and this makes it an additional step for the hacked computer to provide the hacker access to the service.

Answer 10

As suggested, save the password sha1, salted and pepper

 function hashedPassword($plainPassword) { $salt = '1238765&'; $pepper = 'anythingelse'; return sha1($salt . sha1($plainPassword . $pepper)); } 

and then compare the two values

 if ($stored === hashedPassword('my password')) { ... } 

And if you cannot store hashed passwords outside the root server, be sure to specify apache to block access to this file in the .htaccess file:

 <Files passwords.config.ini> Order Deny,Allow Deny from all </Files> 

Answer 11

The best way is to store the password over the root directory. If you decide to have a password in the php file, the body will not be able to view it, because php files are subtracted on the server. But if the server does not support php, then these files will be delivered as text files, and everyone can see the password.

Answer 12

What if I create a second web server (it could even be an intranet server that is not accessible via the Internet at all) to send a password to a php script located on a public server that is going to connect to the database?

Thus, I can use the allow directives in the second websever so that it only responds to the first and refuses all other IP addresses. Thus, a publicly accessible server never stores a password; it only asks for it if necessary. I think this is a good idea, what do you think?