Password Protection Question

adavis

I'm trying to decided how to password protect some pages on my site. I could have up to 100 users who will only have access to update specific pages. Most will only have permission to access only one page, a few would have permission to access 2 or 3 pages, while a small handfull could have permission to access many of the pages. The options as I see them are to either give each user a username and password and specify which pages that user is authorized to access or to give each page it's own username/password. If I go with the first option, I was thinking about something like this:

id | username | password | page

In this case, I could have multiple entries for the same username/password, but only one unique entry for username/password/page.

Any of you doing something similar who could give me advise on pitfalls or other things to look out for?

Thanks

Weedpacket

That makes for a fair bit of duplication. Better normalisation: three (or two) tables. One for usernames and passwords, the other for pages.

User table:
id (unique) | username | password | [other user-specific stuff]
A list of users, each with a unique ID used to reference it in other tables.

Page table:
id (unique) | page | [other page-specific stuff]
A list of pages, each with a unique ID used to reference it in other tables.

Page access table:
id (unique) | userid | pageid
Which has a record for each page that each user can see. userids can appear multiple times (a user might have access to more than one page), and so can pageids (a page might be visible to more than one user).

If there is no other page-specific stuff, then you can fold the last two tables together:

Page/access table:
id (unique) | userid | page

sfhc

it is simpler to do this

you have 3 types of pages that can be viewed, so therefore you have 3 types of users.

assign each user a class in the db

DB: userID, pwd, userClass

on your pages some how identify them

$thisPageClass=0;

// assuming you have some user data in session from the log in routine

if($_SESSION[userType!=0){
// user does not have access to this page
exit;
}

Weedpacket

No, there could potentially be as many classes as there are users (their own, for example). Yours is just a more restricted (and actually more complicated) version of mine.

adavis

Thanks Weedpacket. Your suggestion makes the most sense of all I've considered. I am working on designing my database tables now. Here's what I've come up with:

CREATE TABLE login (
id int(11) NOT NULL auto_increment,
username varchar (20) default NULL,
password varchar(10) NOT NULL default '',
lastupdated int(24) default NULL,
PRIMARY KEY (username)

) TYPE=MyISAM;

CREATE TABLE logpage (
id int(11) NOT NULL auto_increment,
username varchar (20) default NULL,
email varchar(100) default NULL,
phone varchar(20) default NULL,
lastname varchar (50) default NULL,
firstname varchar (50) default NULL,
pagename varchar (50) default NULL,
lastupdated int(24) default NULL,
PRIMARY KEY (username)

) TYPE=MyISAM;

CREATE TABLE pagename (
id int(11) NOT NULL auto_increment,
pagename varchar (50) default NULL,

variables will vary depending on the page and page type .....
There will be one for lunch menu, one for weekly newsletter then one template that is similar to the lunch menu for assignments, and one bio page template which each individual teacher will maintain.
Lunch Menu, Newsletter, & Teacher Bio/Pages will write over previous information
Assignments & Calendar entries will be appended to the end of the database file
Athletics schedules/scores/rosters will be entered at the beginning of the season and updated through the season.

PRIMARY KEY (pagename)
) TYPE=MyISAM;
------------------------------------------------------------------------------------