What are the potential security risks of storing user credentials in a PHP script for authentication purposes?

Storing user credentials in a PHP script for authentication purposes poses a significant security risk as the credentials can be easily accessed by anyone who has access to the script. To mitigate this risk, it is recommended to store the credentials securely in a separate configuration file outside of the web root directory, or better yet, use a secure hashing algorithm like bcrypt to store hashed passwords instead of plaintext. 

// config.php
define('DB_HOST', 'localhost');
define('DB_USER', 'username');
define('DB_PASS', 'password');
define('DB_NAME', 'database');

// authentication.php
require_once('config.php');

// Use the credentials from the config file for database connection
$conn = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);

Keywords

SQL injection password hashing secure storage cross-site scripting session hijacking

Related Questions