I know that with the following code we can login a user programmatically.

$username = "someuser";
$password = "somepass";
$uid = user_authenticate($username, $password);
if ($uid) {
 $form_state = array();
 $form_state['uid'] = $uid;
 user_login_submit(array(), $form_state);

But is it not a security risk to store the username and password in variables like above?

Is it the safe way or is there any other method for username and password to get?

  • It depends on what you mean by a security risk. Entering the values into your code may be a security risk, if other people will be viewing said code, but as far as the code itself, it's not particularly a security risk. – Jaypan Sep 30 '16 at 7:24
  • I just want to confirm this. As I heared that the username and password should be in another conf file and will get from there. But I don't know about this therefore I'm asking. – Ahmad Sep 30 '16 at 7:25
  • If you add the user story for context, I'm sure can get an answer that doesn't involve storing user credentials in clear text. – Shawn Conn Oct 1 '16 at 1:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.