Is it unsecure to...

[ShoeLace1291]

In the past, when I develop a website it usually consists of a members database and login system.  Currently, I am in the process of creating my own personal website.  I am going to develop an admin area for myself to easily manage the content, but I will be the only person using it.  Instead of making a members table in the database, I thought I would just store the admin login information in a config file, and then validate the login information based on that.  A though came across my mind, however, that it might be unsecure to  do this... can anybody think of any reason as to why doing this would be unsecure?

[xyph]

Make sure the config file is outside of the webroot.

 

Beyond that, you should be fine. If you're going to store it in plain-text, make sure it's a password you don't use anywhere else.

[spiderwell]

or you could use the webserver to protect a folder with a password.

 

if you put it into a php file, even if the file gets executed, the php code wont be viewable in the client

[xyph]

or you could use the webserver to protect a folder with a password.

 

if you put it into a php file, even if the file gets executed, the php code wont be viewable in the client

 

There's no reason at all to put sensitive information within the web root. Why even give the opportunity to parse it?

[scootstah]

or you could use the webserver to protect a folder with a password.

 

if you put it into a php file, even if the file gets executed, the php code wont be viewable in the client

 

There's no reason at all to put sensitive information within the web root. Why even give the opportunity to parse it?

 

Barring some serious flaws in your code, there's no way to output the contents of a PHP file by executing it on the webserver. If there was, a lot of websites would be in deep trouble.

 

So, while I do agree with you, there isn't an immediate cause for concern by storing a password in a php file. After all, that is how nearly every PHP CMS and framework stores database credentials.