PHP文件将密码存储为文本文件

Question

For my very small website that only friends know of, I am developing a password system. I am saving the passwords in a php file like this.

<?php
if($_GET["p"]=="password"){
?>
user1 password1
user2 password2
<?php
}
?>

Then, I can read the password with file_get_contents(pass.php?p="password"); And I can still write the password by writing to the php file just like I would a text file. Is this method insecure? Are there similar methods that are that do not require a database? I don't think my site needs encryption, it wouldn't hurt too much if the passwords were compromised.

Answer 1

Whoa. I would say it's quite insecure. Is there a reason why for not using a database?

Also alternatively, to make it more secure without a database if you wish, you could create a combination of username+password with md5 and/or sha1 encode and save it as an extensionless file in a directory, and compare if the combination is right with file_exists