Is it ever ok to store password in plain text in a php variable or php constant?

by

The short answer is both No, and It Depends.

It’s almost never a good idea to store passwords in plain text, especially in a web accessible location, if for no other reason than a simple server misconfiguration or an echo in the wrong place could expose it to the world.

If you MUST store a password, (which is possible) you could try to store it outside the webroot, eg
/var/www/public_html/ Put your codez here
/var/www/includes/ Put your passwords here

Even better than that would be to have the system that you need the password for (eg a database wrapper ) return an object already instantiated. so rather than asking for $databasepassword you ask for a PDO object, and store your database classes outside the webroot.

The It Depends comes from what attack vectors would cause someone to have access to that password text, and would it require them to be already inside your filesystem, if so, you’re probably screwed anyway.

Also, if its the password to your supa-secrit subscriber content, meh, all you’ve lost is some subscription fees, if its your database, you may have a problem, if it’s your online banking details, um good for you.

How valuable is the thing the password is protecting?

More Related Contents:

  1. Secure hash and salt for PHP passwords
  2. How can I store my users’ passwords safely?
  3. Two-way encryption: I need to store passwords that can be retrieved
  4. Generating a random password in php
  5. How to best store user information and user login and password
  6. encrypt and decrypt md5
  7. How to create a laravel hashed password
  8. Many hash iterations: append salt every time?
  9. a better approach than storing mysql password in plain text in config file?
  10. Unique key generation
  11. xss attack on a php page
  12. How can I sanitize user input with PHP?
  13. How do you Encrypt and Decrypt a PHP String?
  14. How to create a secure mysql prepared statement in php?
  15. Simplest two-way encryption using PHP
  16. Using PHP 5.5’s password_hash and password_verify function
  17. PHP MySQLI Prevent SQL Injection [duplicate]
  18. How to fake $_SERVER[‘REMOTE_ADDR’] variable?
  19. Best way to defend against mysql injection and cross site scripting
  20. Login without HTTPS, how to secure?
  21. Is it safe to trust $_SERVER[‘REMOTE_ADDR’]?
  22. How to get rid of eval-base64_decode like PHP virus files?
  23. How to sanitze user input in PHP before mailing?
  24. Using PHP/Apache to restrict access to static files (html, css, img, etc)
  25. How can I determine a file’s true extension/type programmatically?
  26. Can I serve MP3 files with PHP?
  27. How to log in to phpMyAdmin with WAMP, what is the username and password?
  28. Is it possible to execute PHP with extension file.php.jpg?
  29. Sanitize file path in PHP
  30. When to use filter_input()

Leave a Comment