What are some common pitfalls when using text files for user account storage in PHP?

One common pitfall when using text files for user account storage in PHP is the lack of security measures, such as encryption or hashing of passwords. To solve this issue, passwords should be securely hashed before being stored in the text file. Another pitfall is the lack of input validation, which can lead to vulnerabilities like SQL injection or cross-site scripting attacks. To address this, input from users should be properly sanitized and validated before being written to the text file.

// Example of securely hashing passwords before storing in a text file
$password = "password123";
$hashed_password = password_hash($password, PASSWORD_DEFAULT);
file_put_contents('user_accounts.txt', "username:hashed_password\n", FILE_APPEND);

// Example of input validation before writing to a text file
$username = $_POST['username'];
if (preg_match('/^[a-zA-Z0-9]{5,20}$/', $username)) {
    file_put_contents('user_accounts.txt', $username . "\n", FILE_APPEND);
} else {
    echo "Invalid username format";
}