-2

I have a hand built website, and am triying to build a cms/admin-panel, and my username and password, are not stored in a database, but, in a two setup file like seen below.

index.php

<?php 
session_start(); 

define('DS',  TRUE); // used to protect includes
define('USERNAME', $_SESSION['username']);
define('SELF',  $_SERVER['PHP_SELF'] );

if (!USERNAME or isset($_GET['logout']))
 include('login.php');

// everything below will show after correct login 
?>

login.php

<?php defined('DS') OR die('No direct access allowed.');

$users = array(
 "user" => "userpass"
);

if(isset($_GET['logout'])) {
    $_SESSION['username'] = '';
    header('Location:  ' . $_SERVER['PHP_SELF']);
}

if(isset($_POST['username'])) {
    if($users[$_POST['username']] !== NULL && $users[$_POST['username']] == $_POST['password']) {
  $_SESSION['username'] = $_POST['username'];
  header('Location:  ' . $_SERVER['PHP_SELF']);
    }else {
        //invalid login
  echo "<p>error logging in</p>";
    }
}

echo '<form method="post" action="'.SELF.'">
  <h2>Login</h2>
  <p><label for="username">Username</label> <input type="text" id="username" name="username" value="" /></p>
  <p><label for="password">Password</label> <input type="password" id="password" name="password" value="" /></p>
  <p><input type="submit" name="submit" value="Login" class="button"/></p>
  </form>';
exit; 
?>

Code Source: php - Easy login script without database - Stack Overflow

What is the best way to secure those file.

closed as off-topic by Adi, TildalWave, Xander, Ayrx, Scott Pack Nov 6 '13 at 13:28

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Yes, please post the code. Not that it'd help us answer or anything, but I just would love to see the code for that. – Adi Nov 6 '13 at 12:41
  • 2
    This question appears to be off-topic because it doesn't show the minimum effort or information expected in a question. – Adi Nov 6 '13 at 12:42
  • It might help to think about (and add to your question) who you are trying to secure the usernames and passwords from. – Ladadadada Nov 6 '13 at 12:47
  • I edited my Q, and found the original code i used on my website – blade19899 Nov 6 '13 at 12:53
  • Some suggestions for improving the code (not an exhaustive list): The passwords are not hashed. They should be. There's plenty of code on Sec.SE to use for that. Choose a strong password hashing function, not MD5(). The logout function should also delete the session and expire the session cookie. There should be an exit() after the header() calls or the rest of the page will be executed before the response is sent and the redirect response will include the login form which is wasteful. – Ladadadada Nov 6 '13 at 13:08
4

Owen covered some reasonable changes, but unless the code is a throwaway classroom exercise where no use of a database is possible, the idea of storing user details in a PHP file at all is fundamentally flawed and should really be addressed now before it's too late. Passwords should not be stored in plain text, and managing them hashed stored in this way will at best be cumbersome, but how will users change their passwords for example?

You should also consider the bigger security picture, and what impact there will be when your (or an end user's) server is broken into. How will you stop a change being made to your code to silently log entered user details to a file for later collection by a hacker? (disclosure: I am associated with ionCube)

  • I agree with pretty much everything Nick has put here. My advice was to negate the risks of storing in a file like this, but it's not actually something I actually recommend. – Owen Nov 6 '13 at 15:23
3

None of this is ideal, but if you are going to store account details in a PHP file, I'd say the following steps are a minimum:

  • Don't store the password in plaintext. Realistically, this is only an extra precaution, but you should take it anyway.
  • Keep the account.php outside the site root, somewhere that cannot be accessed by a direct URL. If your site is in /home/user/www/http_root or something, then keeping the account.php in /home/user/www would be a good idea.
  • Define a constant to show your application is running, and start your account.php file with a line that checks for this constant, or dies if the constant is not set.

All of this is only a vague security improvement, rather than actual best practice.

  • 1
    Restrictive file permissions would be another good addition. Only the web server user should have any (read, write or execute) access to the file. – Ladadadada Nov 6 '13 at 12:49
  • Why would anybody upvote this?! If the password is strong and securely hashed, permissions et al add, practically, zero more security. This is not about strong database credentials. – Adi Nov 6 '13 at 12:52
  • Because even a leak of a strongly hashed password list is embarrassing. No leak at all is better. – Ladadadada Nov 6 '13 at 12:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.