How to secure a login.php file? [closed]

Question

I have a hand built website, and am triying to build a cms/admin-panel, and my username and password, are not stored in a database, but, in a two setup file like seen below.

index.php

<?php 
session_start(); 

define('DS',  TRUE); // used to protect includes
define('USERNAME', $_SESSION['username']);
define('SELF',  $_SERVER['PHP_SELF'] );

if (!USERNAME or isset($_GET['logout']))
 include('login.php');

// everything below will show after correct login 
?>

login.php

<?php defined('DS') OR die('No direct access allowed.');

$users = array(
 "user" => "userpass"
);

if(isset($_GET['logout'])) {
    $_SESSION['username'] = '';
    header('Location:  ' . $_SERVER['PHP_SELF']);
}

if(isset($_POST['username'])) {
    if($users[$_POST['username']] !== NULL && $users[$_POST['username']] == $_POST['password']) {
  $_SESSION['username'] = $_POST['username'];
  header('Location:  ' . $_SERVER['PHP_SELF']);
    }else {
        //invalid login
  echo "<p>error logging in</p>";
    }
}

echo '<form method="post" action="'.SELF.'">
  <h2>Login</h2>
  <p><label for="username">Username</label> <input type="text" id="username" name="username" value="" /></p>
  <p><label for="password">Password</label> <input type="password" id="password" name="password" value="" /></p>
  <p><input type="submit" name="submit" value="Login" class="button"/></p>
  </form>';
exit; 
?>

Code Source: php - Easy login script without database - Stack Overflow

What is the best way to secure those file.

Answer 1

Owen covered some reasonable changes, but unless the code is a throwaway classroom exercise where no use of a database is possible, the idea of storing user details in a PHP file at all is fundamentally flawed and should really be addressed now before it's too late. Passwords should not be stored in plain text, and managing them hashed stored in this way will at best be cumbersome, but how will users change their passwords for example?

You should also consider the bigger security picture, and what impact there will be when your (or an end user's) server is broken into. How will you stop a change being made to your code to silently log entered user details to a file for later collection by a hacker? (disclosure: I am associated with ionCube)

Answer 2

None of this is ideal, but if you are going to store account details in a PHP file, I'd say the following steps are a minimum:

• Don't store the password in plaintext. Realistically, this is only an extra precaution, but you should take it anyway.
• Keep the account.php outside the site root, somewhere that cannot be accessed by a direct URL. If your site is in /home/user/www/http_root or something, then keeping the account.php in /home/user/www would be a good idea.
• Define a constant to show your application is running, and start your account.php file with a line that checks for this constant, or dies if the constant is not set.

All of this is only a vague security improvement, rather than actual best practice.