Last week I was looking at a way to make certain areas of a website accessible only via login using username and Password. Virtually everywhere I looked suggested setting up a separate MySQL database with a table containing the user details, and a separate mysqlconnect document. Without a doubt, this would work, but it’s a lot of effort to go to for just a couple of users.
I have come up with a simpler alternative, which uses an array, md5 encryption, session ID and HTTP user agent.
The first thing to do is create a login page which allows the user to enter a user name and password, like this:
<form id=”formlogin” method=”post” action=”login.php”>
Login here:
<p >Username: <input size=”25″ type=”text” name=”username” /><br />
Password: <input size=”25″ type=”password” name=”password” /><br />
<input type=”submit” value=”Login” /></p>
</form>
Right then. As you can see from the <form> tag, the info submitted is sent to login.php, so we need to create that now. Here it is:
<?php
session_start();
$passwords = array(”First User” => “first password”,
“Second user” => “next password”,);//add as many users as you need
if (!$_POST["username"] or !$_POST["password"]) {//checks if username & password entered
echo “Please enter your username and password.”;
echo ‘<a href=”login.html”>Log in</a>’;//link back to login form
exit;
}
$pass = $_POST["password"]; //assign entered password to variable
//If password is ok, set session IDs
if ($pass == $passwords[$_POST["username"]]) {
$_SESSION['auth_username'] = $_POST['username'];
//user agent stored to reduce chance of session being hijacked - user agent encrypted with md5
$_SESSION['agent'] = md5($_SERVER['HTTP_USER_AGENT']);
print “<meta http-equiv=\”refresh\” content=\”0;URL=webpage.php\”>”; //redirect to selected page
}
else {// set error message
$msg_error = ‘Login failed. Please go back and try again.’;
}
//The html below only displayed if login was not successful
?>
<html>
<head>
<link href=”/css/style.css” rel=”stylesheet” type=”text/css” />
<title>Login failed - Web developing by Jez D</title>
</head>
<body>
<p>
<?php
echo $msg_error;
?>
</p>
</body>
</html>
Ok. The next step is to put a small PHP script at the top of each PHP page you wish only authorised persons to see. It must go before everything else in the page. This script checks to see if session ID’s have been set and, if they have, are they valid. If not, it doesn’t allow the user to see the contents of the page. The script looks like this:
<?php
session_start();
if ((!isset($_SESSION["auth_username"])) OR ($_SESSION['agent'] != md5($_SERVER['HTTP_USER_AGENT']))) {
echo “<p>You must be logged in to view this page.</p>”;
echo ‘<a href=”login.html”>Login</a>’;
exit;
}
Now that works a treat, but there are a couple of other things you may wish to consider doing for even more increased security.
- Move the file containing the user details (login.php) to a folder not accessible to a web browser, but not password protected.
- Replace the passwords as stored in login.php with encrypted versions of the same words.
Find out what the encrypted version of the password is by using an encryption tool I have created:
Then replace the password in the array with the output from the script above.
Now you need to replace:
- $pass = $_POST["password"];
with
- $pass = md5($_POST["password"]);
The user can still log in with the unencrypted password, the script encrypts it and then compares it to the encrypted version stored in the array. If someone manages to get access to the script, they will only see the encrypted version of the password. If this is entered in the login form, it will be rejected.
Filed under: Web development | Tagged: php, session ID, MySQL, login, log, in, secure, md5, password, username, encryption, http, user, agent, HTTP_USER_AGENT, session_start() | No Comments »
Fortunately, I arrived early enough to have time to cruise around looking for a suitable parking space.
The interview was really more of a chat about what they were looking for and what I can do. They were looking for a programmer competent in PHP, XHTML, CSS and MySQL. It appeared to be ideal for me.
I was elated, as they build them exactly the same way I built my 
