Here's the deal: I need to store some sensitive data (user names and passwords) in a flat file.

Of course, the passwords will be md5 encrypted in the file, but this wouldn't be enough.

This neat little login system, Micro Login System, seems to have the basic stuff for me to start with but, as said it stores the user info in a text file.

The contents of userpwd.txt would have been:

admin:3089af3a625carf15ed2a1a93684413ffa
user1:75580656a394292460ebb4b036ebeaf1
user2:c67ac4665947cd23ff7d1d180b8e41d5

That's user : md5( password ).

I was concerned about this because anyone who knew about the system could have entered address/userpwd.txt in the address box and gotten that info.

My solution

Php files are pretty secure right?...

How I use captcha without making my users complete the barely readable word

What I wanted was to have the commenting feature protected against spam bots without having the innocent human users ruining their eyes on captcha like images, or complete any mathematical equation or any other additional question fields.

One very important difference between a spam bot and a human using a web browser is that the first can't run JavaScript code. However, this isn't a perfect criteria of selection, because there are humans browsing the web using browsers without JavaScript support (Opera Mini for mobile devices for example).

My ideea (and as I did some Google searches, I found out other people had similar ideas) was the followig algorithm:

Does the user have JavaScript enabled?
If yes, he's ok. Let him comment.
No? He's a suspect. Read him his rights and give him the ultimate "are you human?" test.

Put your city on the map in 4 layers. Create an artistic old map of your area.

Here's what you should be achieving: