Autorized page Access

knight · February 26th, 2004, 04:25 AM

how can i restrict the user to view some pages without authorize access i think it is control via session if yes then how? and if other method pls tell me

CFerthorney · February 26th, 2004, 06:16 AM

It is possible to use sessions. DO this by ensuring every page has the code

Code:

<?php
session_start();
?>

BEFORE ANY OTHER code Then on your login.php page have a form that "logs the user in" by setting

Code:

<?php
$_SESSION['username'] = $_POST['username'];
//Any other information you want stored can go here as well, be 
//careful with passwords.
?>

The above code assumes your form method was "post" (If it was get, use $_GET) and the textbox containing the username was called username (Case sensitive) I recommend $_POST as it stops the user entering a known user name in the address bar and gaining access that way.

Then on each "protected" page something like the following, after the session_start();

Code:

if (!isset($_SESSION['username']))
{
    header('location:login.php'); //Send them to the login page
}

else
{
    //Your page code here
}

If that sounds terribly complicated try a .htaccess page. They lock out users by requiring authorisation (For .htaccess pages to work you need to be using php with Apache not IIS) the syntax for a .htaccess for can be found at the following URL
http://apache-server.com/tutorials/A...-htaccess.html
Below is an example of a .htaccess file I wrote (paths obscured for obvious reasons)

Code:

AuthUserFile /full-path/to/password/file
AuthName "area name here"
AuthType Basic
require valid-user

You need to make sure that the hosting directory in the httpd.conf file has AllowOverride AuthConfig in it.

You also need to create a .htpasswd file (Make sure it starts with ".ht" as it will be more protected under Apache) in the command line type the following

Code:

htpasswd -bc ./.htpasswd user password

Then for each subsequent user lose the c. The "c" parameter creates the file.

hth

---
David Thorne, Student
UK

nikolai · February 26th, 2004, 06:55 PM

Keep in mind that unless you're running a site on a secure connection (i.e. https://, not http://), all your passwords will be sent as plain text to the server.

Standard HTTP authentication (i.e. using apache's .htaccess files) doesn't really provide any security for anyone who's really interested in gaining access to restricted information.

Using standard HTTP authentication parameters (username, password) and entering a username/password in the "Authorization Required" popup box is the same thing as putting the username/password in the URL to begin with.

More plainly:

http://<username>:<password>@<url>/

Take care,

Nik
http://www.bigaction.org/