Securing pages..please help...!

amod

Im running Omnihttpd instead of apache at home for testing and i wanted to know if theres a way to secure my web pages.

maybe some php inbuild function or some html code lets you do that. im running windows so options are limited.

also the data for authentication (user/pwd) is coming thru a mysql database and not a file..so im not sure if i can use .htaccess method.

pl. suggest.

Thanks.

stolzyboy

you can do the .htaccess method, but may be a little more difficult to handle that the session route

http://www.php.net/session_start

tomwerner

you don't need to use .htaccess unless there is a specific reason why you need it. Using mySQL is a great start for securing webpages, to make your scripts even more secure try using the php function md5(), this means that if someone hacks your database the passwords are not available. The reason is that md5 encrypts the password in the database using an irreversiable process, when you login using the web interface md5 your password and if the password is correct they will match up (this is because md5 gives the same output for the same string everytime). sorry if that was a bit complicated / overkill for what you need.

tomwerner

here is an example of the code you will need:


// Connect to database

if (md5($_POST['entered_password'])) == $mysqlresult['password'])
{
print("Congrats, you are authorised");
}
else
{
print("Wrond Password, go back and try again");
}

Obviously you will need to change the variables to suit your script but that hopefully explains what I was trying to get across in my last post.

amod

thanks for your help guys....but actually i was aware of all that...but my main question is suppose if after this authentication user is taken to some "admin.html" which gives u access to some administrative features....now what is stopping anyone to go directly to this page if he/she knows the link to this page.

so my aim is to stop anyone from coming directly to this page...its like preventing people from coming to the Members section of some paid website.

I hope this clears my question.

jimson

then u need to use session or cookie to valid the users...
check them whether they are valid user or not

stolzyboy

sessions or htaccess will do for that

you can check for a session and if there isn't one don't let them in

or use htaccess to do pretty much the same thing

amod

thanks a lot for your help guys but i was wondering if htaccess is only used with apache ?....and i will be glad if someone could tell me in brief about sessions in php or maybe a link cos the php manual isn't helping too much.

Thanks!

stolzyboy

you can use .htaccess with windows also

and here is a link for a simple login script using sessions, it is pretty self explanatory

i gave it to others on this board to use

http://www.phpbuilder.com/board/showthread.php?s=&threadid=10239073&perpage=15&pagenumber=3

amod

thanks for your help...i hope this works!

Mattmanx

Hey guys, I really appreciate this thread, I was about to post this exact question earlier this morning.

I used your script and customized it a little bit to work with my page titles, and i also changed the login and password to check with a table of users in my mysql database. However, I'm getting a wierd error when auth.inc.php tries to session_start(). I think it might be a problem with the security settings on my webserver? I'm not sure cause I'm new to this stuff and just set up the webserver yesterday and mysql today. Heres the errors I'm getting:

Warning: session_start(): open(/tmp\sess_cd7e718a677835d56037ce9cda237eec, O_RDWR) failed: No such file or directory (2) in f:\Inetpub\wwwroot\auth.inc.php on line 2

Warning: session_start(): Cannot send session cookie - headers already sent by (output started at f:\Inetpub\wwwroot\auth.inc.php:2) in f:\Inetpub\wwwroot\auth.inc.php on line 2

Warning: session_start(): Cannot send session cache limiter - headers already sent (output started at f:\Inetpub\wwwroot\auth.inc.php:2) in f:\Inetpub\wwwroot\auth.inc.php on line 2

Warning: Unknown(): open(/tmp\sess_cd7e718a677835d56037ce9cda237eec, O_RDWR) failed: No such file or directory (2) in Unknown on line 0

Warning: Unknown(): Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/tmp) in Unknown on line 0

TIA and thanks for all the help you've given already...

Matt

Mattmanx

Okay, I fixed some problems, looked at the php manual, changed my file path for session_start() to look to. However, I'm still getting these two errors and I can't figure out why...

Warning: session_start(): Cannot send session cache limiter - headers already sent (output started at f:\Inetpub\wwwroot\template.php:2) in f:\Inetpub\wwwroot\auth.inc.php on line 3

Warning: Cannot modify header information - headers already sent by (output started at f:\Inetpub\wwwroot\template.php:2) in f:\Inetpub\wwwroot\auth.inc.php on line 7

Someone please help 🙂

Thanks,
Matt

tomwerner

you need to make sure that the session_start() code is the very FIRST thing after <?PHP. Make sure that this is even before the <html> tag of your document. This is because you cannot send headers (sessions use these) after anything has been outputted by the script. The only way to start a session after headers have been set is changing a setting in PHP.ini although I seem to recall you do suffer a performace hit. In response to a previous post yes, .htaccess is an exclusive feature to Apache. Good luck, sessions are useful but very irritating sometimes!

Mattmanx

LOL thanks for your help.. I took a look at my code and could see nothing above the session start... until i looked a little closer and saw that there was a space between the top of the document and the start of my php.

Geez, what a pain, I can't believe that would screw it up.. hah

Thanks

Matt