Security

[Hamsterpants]

Hi All,

Can someone please tell me wich is the best and most secure way to password protect a PHP site. New to PHP so not sure. I nknow that with perl for example you would use .htaccess, but ot sure if you can use that with PHP??

Thanks inadvance
Dill

screamingblue.com

[jerdo]

Yes you can still use .htaccess with PHP. Since .htaccess is part of the Apache server, having PHP doesn't effect it.

[Radon3k]

.htacess is good for password protecting a directory, but if you just want something like a simple login system then I would use the md5() function. It encrypts the password into a 32 character hash and once you encrypt it, you can't decrypt it.

[Hamsterpants]

Thanks guys, that answers my question. Setup .htaccess in the folder I wanted to protect, and used an online password generator, username I used to test with was 1 and password was 1, yet it won't accept my password. Is there something I need to change in the http.conf file or or anything, or do you thing that it maybee not locating the correct password file. .htaccess is setup as follows:

AuthName "Admin"
AuthUserFile c:/phpdev/Apache/.htpasswd
AuthType Basic

<Limit GET>
require valid-user
</Limit>

I aved the .htpasswd file in that same directory
Any ideas?

Dill

[jerdo]

Did you use the htpasswd utility that comes with Apache to manipulate the .htpasswd file? If not then try that, because it encodes the passwords differently than say md5.

[Hamsterpants]

I used an online tool that I found.... Don't know much about apache...how do I access the built in apache password creation tool?

Dill

[jerdo]

Go to the bin directory in your apache installation directory (something like c:\program files\apache group\apache2\bin by default install). If you installed 1.3.x take the 2 off the apache2.
The usage of the utility is like this:

htpasswd -c path to where you want it/.htpasswd username

The -c creates a new file, the username is self explanatory and once you hit enter it should prompt you to enter a password.

[Hamsterpants]

Thanks Jerdo,

That worked like a charm 🙂