title: PHP - Encryption security concern (Am I vulnerable?)
body: <p>I want to connect to ssh via PHP. I can do that easily but the problem is the integrity of the login details (username, password). When I first tried the code I stored my username and password in plain sight. I thought about encrypting those variables. By looking at other questions I found <code>libsodium</code>: <a href="https://github.com/jedisct1/libsodium-php" rel="nofollow noreferrer">https://github.com/jedisct1/libsodium-php</a> </p>
  
  <p>I am using their first example of encrypting a string:</p>
  
  <pre><code>$secret_key = sodium_crypto_secretbox_keygen();
  $message = 'Sensitive information';
  
  $nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
  $encrypted_message = sodium_crypto_secretbox($message, $nonce, $secret_key);
  
  Decryption:
  
  $decrypted_message = sodium_crypto_secretbox_open($encrypted_message, $nonce, $secret_key);
  </code></pre>
  
  <p>By looking at the example you can see <code>$encrypted_message</code>, <code>$secret_key</code>, <code>$nonce</code>. I am inserting these variables in the database when I am encrypting the login details and then I am fetching them when needed in the decryption code.</p>
  
  <p>I am also storing my database connection script (<code>PDO</code>) in a folder where there is a <code>.htaccess</code> file with the following content:</p>
  
  <pre><code>order deny,allow
  deny from all
  allow from 127.0.0.1
  </code></pre>
  
  <p><strong>1.</strong> Is my approach safe and hack-proof? </p>
  
  <p><strong>2.</strong> If somebody breaches my database will they be able to use my users' data? </p>
  
  <p><strong>3.</strong> How effective is the .htaccess file and can it stop hackers from accessing the database connection file?</p>