Quickie on security.

Anon

Hi guys,
I'm not looking for detailed explanations and examples but I'd like to know what functions to start reasearching for this little scenario:

I want to have an admin section on a site that allows a authorised persom to manipulate the content DB.
I don't need to register loads of users but need to allow one or two registered users access to the progam.

Where should I start my research? Securiity is a new area for me so please keep it genereic and I'll work out the details myself.

Msny thanks

Nick

alcapone

Nick, what you need is a usuall administration routing inside some portals. I thisnk you have a db with users, correct? if so just make one more column named, lets say, 'status'. And in there put something basic like 'admin' or 'banned' or 'writer' or whatever you want. Thats how I use it and it doesn't seem to have a probs.

cheers,
AlCapone

jc94062

Well, for something like db access, I'd use .htaccess, its pretty darned secure, even if not the most friendly looking interface.

The other way is to have some kind of field in a member table with an admin level where 0 gives them nothing, 1 gives them access, obviously this can be expanded.

To keep people logged in its cookies or sessions, both have their advantages, and I prefer cookies, but I'd make sure you encrypt whatever you put into a cookie, and also keep it as a session cookie, that way it can't be read without some kind of packet sniffer, making it harder to spoof.

Heres a page on web security (authentication actually) that I saw as well

http://www.wwnet.net/~janc/auth.html
Its pretty in depth tho, so maybe MORE than you wanted.

Hope that helps

Anon

Yeah thanks guys, i'ts a little closer to james' understanding of it.
I know about .htaccess but actually I'd read that it wasn't all that secure? I was thinking along the lines of authentication I guess.

Cheers

Nick

matto

I have a login page.
it checks with the db (could also be hardcoded, if you have only 2 users as you wrote) whether the pwd/id combination is valid. if yes, the script sets a session variable userid and one for the password.

-> lookup sessions, session_register

in the top of each protected script, before anything is put out, this check is done again: is the pwd/id combination in the session vars valid? if no -> loginpage.

if the user clicks logout, -> loginpage.

at the start of the loginpage, the session is destroyed, and immediately after that started again.

-> session_destroy

the user check can sit in an include library file and return true if the combination id/pwd is valid.

-> include, function, return, global

good luck!

matto

well, and: see header(), this can redirect "invalid" users to the login page.

Anon

Great, thanks very much.
What about encryption?

Nick

jc94062

As far as I know .htaccess is about the best you can get in security (without SSL of course) and is one of the easiest types of security to set up, just not that great a user interface.

Can also be used on pratically every host as well, even geocities I think.
Course geocities doesn't support PHP (or damn nearly anything else)

jc94062

avoid hardcoding, unless its in combination with something else.

md5() is great for one way encrpytion, mcrypt() (think thats right) can be decrypted if you want to give them their password back when lost.

Important note about encryption...

Unless you using SSL, the password can still be seen in plain view as the form is submitted, therefore, the only good thing about it is that it is stored as a 32 bit hash in db field (if md5 is being used).
Now, this means if someone views your db they can't see that person password, but if someone manages to see your db, you got bigger problems...

So, if some people are gonna be able to see your db, maybe its good, but then again you can always store them somewhere else in plain text and just add when users sign up and update when they change their passwords, of course you'd want to hide this table / file / whatever from view.