Member Avatar for MDGM

Hi all,

i need a password script for one page which takes you to the next page. I dont have access to a database so i need it to be stored either in a txt filfe or in the script itself. Thanks!!

Max :mrgreen:

  • 3 Contributors
  • 4 Replies
  • 132 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by MattEvans

Dani AI

Generated

The thread shows a common constraint: a simple password gate without a DB. found a quick client-side resource and the replies from and correctly point out the trade-offs you’ll face: convenience vs real protection and ongoing manageability. Below are practical alternatives and operational tips that still work when a full database-backed auth system isn’t available.

For a small number of pages the easiest robust option is server-level auth (no app code required). Apache’s .htpasswd/.htaccess or nginx auth_basic give real access control and are straightforward to configure; always run them over HTTPS. See the official server docs for setup details: Apache HTTP Server authentication howto and nginx auth_basic module.

If you need a form-based login, implement it server-side and keep secrets out of the webroot. Store only a strong salted hash (bcrypt/argon2) in a file outside the document root, use language-provided verify functions (for PHP see password_hash/password_verify), create a short-lived session on success, and set Secure and HttpOnly flags on cookies. Follow the OWASP authentication guidance to avoid common mistakes: OWASP Authentication Cheat Sheet and PHP password_hash documentation.

Practical reminders: never leave secret files in a web-accessible folder, disable directory indexing, enforce HTTPS, restrict file permissions, log and rate-limit failed attempts, and rotate credentials when needed. Techniques that rely on obscuring filenames or embedding secrets in client-visible scripts are brittle; they can work for very low-risk content but are not a substitute for server-side controls and proper hashing.

Recommended Answers

All 4 Replies

Member Avatar for Member #114696

But one thing, if you store your password in a text file the it is surely insecure. Storing it in script(in a server-side one) would secure to an extent cause others may not see your source-code hence the password, but you will always have to change the code whenever you want to change the password. By changin the code I mean changing the variable that stores the string.

Member Avatar for MDGM

the password in the script is encrypted. Thanks anyway. Max

Member Avatar for MattEvans

that code is actually not too bad, i had a quick look at it yesterday... it's more secure than just "put a javascript index infront of private files" it works because no outsider knows the filename of the private file: and the encrypted password is used in the name of the private file... EDIT: the password isn't stored but a password that doesn't match up with the filename after a relatively simple 1-way cryptogram won't open any pages.

it might prove totally unmanageable for more than one or two pages though, and it's not a perfectly secure solution.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.