Ive got to agree with jordy on this one. Unless a customer specifically requests to use the .htaccess / .htpasswd files, I almost always let php/mysql/md5 hashes do the work for me. It's quite easy to write a script to include in your secure pages to validate the user.
Here's the way I usually do it. . . Note that there are several ways to do it, this is just mine.
<?php
// This is the script that performs the initial authentication
$userstats = auth($user, $password);
// If userstats=1 then the username - password combination was found... Look up any additional credentials and create a session
if ($userstats == 1)
{
$query = "SELECT UserFirst,UserLast,UserAccessBits from users WHERE UserHandle='$user'";
$result = mysql_query($query) or die("Fatal Error: mySQL Query ($query) Failed");
$data = mysql_fetch_array($result);
$firstname = $data['UserFirst'];
$lastname = $data['UserLast'];
$accesslevel = $data['UserAccessBits'];
// Make sure this is not a banned user
if ($accesslevel != -1)
{
session_start();
session_register("SESSION");
session_register("SESSION_UNAME");
session_register("SESSION_FULLNAME");
session_register("SESSION_USERACCESS");
$SESSION_UNAME = $user;
$SESSION_FULLNAME = "$firstname $lastname";
$SESSION_USERACCESS = "$accesslevel";
}
header("Location: http://www.*******.com");
exit;
}
else
{
// If code gets here, username/password combo not found in db
header("Location: http://www.*******.com");
exit;
}
// Authentication Function
function auth($auser, $apass)
{
$result = -1;
include ("global.php");
$link = mysql_connect("localhost","dbusername","secret") or die("Fatal Error: Unable to connect to mySQL!");
mysql_select_db("eba") or die("Fatal Error: Unable to open eba database!");
$query = "SELECT UserHandle,UserPassword from users WHERE UserHandle='$auser' AND UserPassword='$apass'";
$result = mysql_query($query) or die("Fatal Error: mySQL Query ($query) Failed");
if (mysql_num_rows($result) == 1)
{
// found user/pass
return 1;
}
else
{
// dod not find user/pass
return 0;
}
}
The above code is called via the following. . . And yes, it's straight HTML...
<HTML>
<HEAD>
<TITLE>Please Login</TITLE>
</HEAD>
<BODY>
<CENTER>
<TABLE BORDER="0" CELLSPACING="5" CELLPADDING="5">
<FORM ACTION="login.php" METHOD="POST">
<TR>
<TD>Username</TD>
<TD><INPUT TYPE="TEXT" SIZE="16" NAME="user"></TD>
</TR>
<TR>
<TD>Password</TD>
<TD><INPUT TYPE="PASSWORD" SIZE="16" NAME="pass"></TD>
</TR>
<TR>
<TD COLSPAN="2" ALIGN="CENTER"><INPUT TYPE="SUBMIT" NAME="SUBMIT" VALUE="Log In"></TD>
</TR>
</FORM>
</TABLE>
</CENTER>
</BODY>
</HTML>
As you can see, very basic 😉 This particular one doesn't even user md5 (hrmm... I guess I better update it... lol)
At any rate, something similar to this would probably do what you want with minimal changes. Once the user logs in, you just include a script in any "secured page" that checks the session to see if a valid user is present.
Hope this helps some..
