Hello again,

I've made a text file, and in with all the information is a password. It's easy to find, if you know where to look, so I'd like to be able to hide it. Here's my text file:

***Stuff I need to hide***Just some Information|

Now, I have my script to echo everything to the page. It needs to do that, otherwise my other scripts won't work.

How can I just output "Just some Information" minus the ***Stuff I need to hide***?

I've thought, just echo everything after the second find of "***", but I need to have it there, just invisible.

I've also tried this:

<?php $hiddenstuff = "Stuff I need to hide"; ?>Just some Information|

But when you view the source, you can see in it "<?php $hiddenstuff = "Stuff I need to hide"; ?>Just some Information".

So I need a way for it to echo to the page, but not be visible to either the page or the source...?

How can I do this? It's stumped me for about 10 minutes...

use a .php extension

They're called nutbars (/* */), just put all the info you want in the bars, and you will be able to hide that info, while still being able to put it in the script.

Example:

/* The stuff you put in here is not web-visible, but is still included through the script when you wish to access the source code. Programmers do this a lot to make notes about the things they've programmed, stuff that they should worry about and reference, yet not be visible to the end-user. */

Does this answer your question?

also, in PHP5, you can now use "#", the pound sign.

#not web-visible in PHP5, but not compatible with PHP4!

Yes, I am aware of that.

However, this information I'm hiding is passwords. Any crafty user can get to the right file and all the passwords are there.

And the .php file extension is a good idea, I have a question about it though;
Since I'm using the current one as .txt, I'm using it as a flat-file database. Would the script to write and pull from the flat file database work if it was changed to .php?

Thanks

PHP files are text

the advantage of "hiding" values as variables inside parsable extensions is that unless they are plain text or HTML it will NOT be sent as output to the useragent.
So unless the infiltrator has FTP access the items will not become visible to the outside world.

Alright, thanks!

Originally Posted by Physicsguy

However, this information I'm hiding is passwords. Any crafty user can get to the right file and all the passwords are there.

Passwords that you need only for logging into your own system can be stored in a hashed format. For more information, see the sticky.

Pretty much, the passwords are safe unless the user finds out where they're stored, which is only in the PHP (which they can't see).

For example, all my passwords are stored in a flat file called ' passwords.txt'. Only users that know where passwords.txt is will be able to gain access.

But in the future, an encryption will be included.