ShawnK — Fri, 18 Jun 2004 22:27:12 +0000

oh ya: if you don't want people that aren't logged in to view the page at all use this:

<?php
header(\"Location: yourloginpage.php\");
?>

That will redirect them to the login page!

ShawnK — Fri, 18 Jun 2004 22:25:53 +0000

The best way to do this would be SSL. But, since you probaly don't have and cannot afford you should take a few precautions:

1) ALWAYS ENCRYPT PASSWORDS! The only password that should not be encrypted is the one that comes straight from the password text box that the user types.

2) NEVER store passwords inside of sessions!

Besides that, the safest way to acomplish this is to use 2 tables for your script.

the 1st would be yourdb.USERS:

the 2nd would be yourdb.SESSION:

username | login_time | sessid

Now what you do is when a user logs in you create a random alphanumeric string and store it in sessid. Then store it in the second table along with the user that logged in and the time they logged in at.

NOTE: you repeat the above EVERYTIME they log in

Then, store in your $_SESSION - the username and session id. You can also implode all the other data like email,first, and last in one string called profile.

And in your header file check to make sure that username is set in the session and if it is test to make sure that login_time is before the current time, then check the sessionid. If all return true. Then they're good if not they shouldn't be allowed to view the page.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
if you have a site that all people can view and you have components or modules or blocks that only logged in people can see, then instead of blocking the user from viewing the page in your header file just make a variable $loggedin and make is "true" and then for all your compnents test to see if logged in is true and if so show the component and ELSE don't show.

I hope I helped you and I didn't confuse you.

Suzanne — Fri, 11 Jun 2004 02:48:03 +0000

It sounds like you're on your way. I believe the most secure access involves the session id encrypted in a cookie, and saved to a database. Then each page would read the cookie, check the database, and proceed accordingly (i.e. sorry, session timed out, sorry, you're not logged in, sorry, you're a evil script kiddie, shoo...)