How save password of a third party application in

问题:

I need to save a third-party application password in my PHP application for connect to a API in a background process. I need store the password in a DB, and the password is for each user of the application. But I don´t know what is the correct way to save it for retrieve it after.

I don´t want to save the password without encryption, but I don´t know which is the best method (and easy) to do this

Any idea?

回答1:

Unless there's some sort of OAuth mechanism available for the API you might as well store it in plain text. Once an attacker has access to the encrypted form of the password then they more than likely have access to the code that decrypts it.

My preferred method is:

inc.credentials.php

<?php
$app_creds = array(
  'username' => 'sammitch',
  'password' => 'isgreat'
);

actual_code.php

<?php
require('inc.credentials.php');
app_login($app_creds['username'], $app_creds['password']);
unset($app_creds);

1. Always uses a file extension that's run through the PHP interpreter so that the file will not be served as plain text.
2. Always leave off the closing ?> so nothing is accidentally output. [most likely whitespace]
3. unset() is mostly paranoia, but just in case of code injection.