[Resolved] Storing a password in an encrypted file for use in a PHP script

[cbj4074]

Hi, everyone!

Here's the story. I'm using a VeriSign Payflow Pro account to perform live credit card transactions on my website.

The pfpro_process() function requires that one's VeriSign account password be passed as a parameter. I don't really want to include the password in plaintext within the PHP file in the event that some clever hacker gains FTP access to my site.

Does anyone know of a way to encrypt the password in an external file, or something similar (even within the same file) to prevent someone who manages to gain FTP access from having everything he or she needs to rip-off the company?

Any ideas are much appreciated!

Thanks 🙂

[The_Chancer]

If you have access to the mcrypt and filesystem functions - store the file outside of the webroot and use an encryption method from the mcrypt library to code the contents of the file....

[cbj4074]

Cool... I've never noticed the mcrypt functions. I'll see what my host supports in their PHP build and give it a shot. Thanks for the info!

[The_Chancer]

No worries - remember to mark the thread as resolved....

[justsomeone]

you might also consider using a php accelerator which stores your code as interpreted, making it illegible. Then you can remove the PHP source.