Methods to secure data files

Using flat files to store data

[Aleister]

A few of my scripts use flat files to store data. Generally I do this for simplicity, and for users who do not have access to MySQL. For larger projects I use databases of course.

There are a few problems with flat files though:

1) Users can view the data file directly - I am not talking about storing passwords or anything, but just email addresses, IPs of visitors, etc. The data file can easily be pulled up in a browser which is not always good.

2) Since the file must have write permission for data to be added by the script, it is possible for someone to append data to the file using alternate methods (besides the intended way).

I have been thinking of the best way to prevent these situations, and wanted to see if anyone had a method they wanted to share.

I know one solution is to store the data outside the public web space, but once again, not all users of the scripts have this option.

One way I was thinking about was to just give the data file a PHP extension, and simply including the following code at the top (which would be skipped by the script when processing the data):

<?php exit();?>

Then to prevent data being appended, there could be a line which tells the script to stop processing the data - an 'end of data' marker. That way if anything is appended after that line, it would be ignored, and the script could even remove it.

I would be very interested to hear any other methods.

Thanks :)

[eelixduppy]

Personally, if your users had that slightest chance that they could use a database, I would go with that.

[coopster]

I would keep the document below the root where it is not publicly available and the script that modifies the document would require authentication prior to use.

[Aleister]

I mentioned above that I am looking for methods that do not involve a database, and do not involve storing the file outside the public web space. :)

Thanks for replying though.

[TypicalSurfer]

htaccess

protect the directory the file is in(deny all but your ip)

use a dot > .textfile

[Aleister]

Ah yes.. I should have remembered that. Thanks :)