-2

I have a hand built website, and am triying to build a cms/admin-panel, and my username and password, are not stored in a database, but, in a two setup file like seen below.

index.php

<?php 
session_start(); 

define('DS',  TRUE); // used to protect includes
define('USERNAME', $_SESSION['username']);
define('SELF',  $_SERVER['PHP_SELF'] );

if (!USERNAME or isset($_GET['logout']))
 include('login.php');

// everything below will show after correct login 
?>

login.php

<?php defined('DS') OR die('No direct access allowed.');

$users = array(
 "user" => "userpass"
);

if(isset($_GET['logout'])) {
    $_SESSION['username'] = '';
    header('Location:  ' . $_SERVER['PHP_SELF']);
}

if(isset($_POST['username'])) {
    if($users[$_POST['username']] !== NULL && $users[$_POST['username']] == $_POST['password']) {
  $_SESSION['username'] = $_POST['username'];
  header('Location:  ' . $_SERVER['PHP_SELF']);
    }else {
        //invalid login
  echo "<p>error logging in</p>";
    }
}

echo '<form method="post" action="'.SELF.'">
  <h2>Login</h2>
  <p><label for="username">Username</label> <input type="text" id="username" name="username" value="" /></p>
  <p><label for="password">Password</label> <input type="password" id="password" name="password" value="" /></p>
  <p><input type="submit" name="submit" value="Login" class="button"/></p>
  </form>';
exit; 
?>

Code Source: php - Easy login script without database - Stack Overflow

What is the best way to secure those file.

5
  • Yes, please post the code. Not that it'd help us answer or anything, but I just would love to see the code for that.
    – Adi
    Commented Nov 6, 2013 at 12:41
  • 2
    This question appears to be off-topic because it doesn't show the minimum effort or information expected in a question.
    – Adi
    Commented Nov 6, 2013 at 12:42
  • 1
    It might help to think about (and add to your question) who you are trying to secure the usernames and passwords from.
    – Ladadadada
    Commented Nov 6, 2013 at 12:47
  • I edited my Q, and found the original code i used on my website
    – blade19899
    Commented Nov 6, 2013 at 12:53
  • Some suggestions for improving the code (not an exhaustive list): The passwords are not hashed. They should be. There's plenty of code on Sec.SE to use for that. Choose a strong password hashing function, not MD5(). The logout function should also delete the session and expire the session cookie. There should be an exit() after the header() calls or the rest of the page will be executed before the response is sent and the redirect response will include the login form which is wasteful.
    – Ladadadada
    Commented Nov 6, 2013 at 13:08

2 Answers 2

4

Owen covered some reasonable changes, but unless the code is a throwaway classroom exercise where no use of a database is possible, the idea of storing user details in a PHP file at all is fundamentally flawed and should really be addressed now before it's too late. Passwords should not be stored in plain text, and managing them hashed stored in this way will at best be cumbersome, but how will users change their passwords for example?

You should also consider the bigger security picture, and what impact there will be when your (or an end user's) server is broken into. How will you stop a change being made to your code to silently log entered user details to a file for later collection by a hacker? (disclosure: I am associated with ionCube)

1
  • I agree with pretty much everything Nick has put here. My advice was to negate the risks of storing in a file like this, but it's not actually something I actually recommend.
    – Owen
    Commented Nov 6, 2013 at 15:23
3

None of this is ideal, but if you are going to store account details in a PHP file, I'd say the following steps are a minimum:

  • Don't store the password in plaintext. Realistically, this is only an extra precaution, but you should take it anyway.
  • Keep the account.php outside the site root, somewhere that cannot be accessed by a direct URL. If your site is in /home/user/www/http_root or something, then keeping the account.php in /home/user/www would be a good idea.
  • Define a constant to show your application is running, and start your account.php file with a line that checks for this constant, or dies if the constant is not set.

All of this is only a vague security improvement, rather than actual best practice.

3
  • 1
    Restrictive file permissions would be another good addition. Only the web server user should have any (read, write or execute) access to the file.
    – Ladadadada
    Commented Nov 6, 2013 at 12:49
  • Why would anybody upvote this?! If the password is strong and securely hashed, permissions et al add, practically, zero more security. This is not about strong database credentials.
    – Adi
    Commented Nov 6, 2013 at 12:52
  • Because even a leak of a strongly hashed password list is embarrassing. No leak at all is better.
    – Ladadadada
    Commented Nov 6, 2013 at 12:53

Not the answer you're looking for? Browse other questions tagged .