login and password

[janet24]

I'm trying to create a simple login and password. I don't know anything about PHP but I'm wondering if I could create one using it. It doesn't have to be safe and I'm not using a database.

thanks..

 

[skiflyer]

You could also just use a .htaccess file depending on your exact goals. But yes you certainly could. You can hard code it into your script, look it up from a text file, look it up from a database, whatever you like... obviouslly different methods will have different levels of security... if you're not wondering about it being safe... then it's really simple something like... a form which POSTS a username and password to a page called "login.php" which looks like...

$name = $_POST["name"];
$pwd  = $_POST["password"];

if ($name == "root" && $password == "password") {
  include "protectedpage.php";
} else {
  die("You're not authorized");
}

Is about the simple security you could put... of course, it'd make a lot more sense to set a session variable or something like that before loading the protected page, otherwise the individual just needs to re-direct directly to the protected page.

Also, all they need to do is look at your script to see the password.

the md5(); function is a nice easy way to make it more secure.

good luck.

-Rob

 

[Chacalinc]

Hi folks,

Take a look to this page:

http://www.desarrolloweb.com/manuales/37/

Title is: "Sistema de Autentificación en PHP" (authentication system in PHP).

Sorry, is in spanish, but it will show you how to use "login & password".

Cheers.

 

[skiflyer]

Header(&quot;Location: <URL>&quot;);

But it must be the first output of the page... you can read up on it here...

http://www.php.net/manual/en/function.header.php

But I use the include for a very particular reason which I forgot to mention, that protected page should be in a location which is not publically accesible. Or you should set some variables above your include, and put a

if (!isset($protectme)) {
  die;

or some such...

The simple reason being, if you just redirect them without a thought, then all someone has to figure out is where to be directed to to avoid your security.

-Rob