在PHP文件而不是用户数据库中存储单个密码

Question

I'm creating an Admin Panel section of a website where there will only be one user. I was thinking of just storing a password in a separate config.php file instead of creating a users table with usersnames and hashed pw's as I typically do for membership areas since it's only one user.

Thoughts on doing this? Has anyone else tried this? Are there some major vulnerabilities I should be aware of?

Example config.php:

$pw = "honeybadgerbubblegum";

Example login.php:

require('config.php');

if(isset($_POST['login']))
{
   $upw = md5($_POST['upw']);
   $pwHashed = md5($pw);
   if($upw === $pwHashed)
   {
   //success
   } 
}

Answer 1

There are no vulnerabilities if you store the password in a PHP file, however, in that case, when the password is changed, it needs to be overwritten, which means that you need to implement a feature which will regenerate the file if the admin saves a new password.

Also, I do not really understand the problem of having a table to hold a single row for the admin. It is not really an overkill and it is a safe and sound method, which would help you to not have to implement PHP regenerators.