Are there any demerit if I use JSON as the storage mechanism, for storing ID/password information ?

Question

I asked for PHP login system and I got answers,

1. lots of files tactics
   * aaa.txt(content is aaa-pass)
   * bbb.txt(content is bbb-pass)
   * and scandir.
2. XML
3. CSV
4. MySQL
5. SQLite
6. PEAR::AUTH

But no one mentioned about JSON.
but I feel JSON is the best way for me.
Because it looks easy , and PHP has JSON dedicated built-in function.
So I am considering to choose JSON for my login system,
but I want to confirm that there is any demerit
if I use JSON for my login script.

Anyone have any opinions?

Answer 1

I'd definitely give you a bunch of demerits, for two major reasons:

1) Never trust anything happening on the client, especially code executing on the client such a javascript. More simply, users can easily modify your authentication code, effectively rendering your authentication useless.

2) Your user database is directly http accessible and in plain text and most likely easily spotted from the source of your scripts or with a HTTP debugger. So after they end up as admin, they will have all your user names and passwords to play with as well.

If you need a login system, build a login system. Or at least fall back on whatever http authentication methods your web server supports.

Answer 2

JSON is as good as any other plain text format for this. Just be sure not to store passwords in plain text. Save them only in a hashed form. And remember to use a salt when hashing. And, whenever it’s possible, try to keep this file out of document root, or at least deny access to it via server configuration.