One way to ensure noone sees the page is to make the file outside of the server root.
On linux if your document root is /usr/local/apache/htdocs you could create a directory /usr/local/files, and put all the html files into that directory. Then use the include from that location. anyone not going through the form will not be able to find it without some serious hacking.
login.html would be something like.
<HEAD>
</HEAD>
<BODY>
<FORM action="login.php" method="post">
<TABLE border=0 cellpadding=2 cellspacing=2>
<TR>
<TD>
Username
</TD>
<TD>
<INPUT type="text" size=30 name="uname">
</TD>
<TR>
<TD>
Password
</TD>
<TD>
<INPUT type="password" size=30 name="pword">
</TD>
</TABLE>
<P>
<INPUT type="submit" value="Login">
</FORM>
</BODY>
login.php would look like Iv hard coded the password and username for demo purposes.
<?php
if ( $uname == "username" && $pword == "password )
{
include("/usr/local/files/firstpage.html");
}
else
{
header("location: login.html");
}
?>
This probably isen't exactly what you have in mind but it demonstrates how to include files not accessable by the server.
Mark.
