Secure login?

flyer

Dear forum...

I have a page called login.php

This is the page where users login. I also have a lot of other pages, for example register.php, logout.php, sendemail.php and so on. I do not want any user to access these pages directly. I want them to follow my links only. And if a user logs out I do not want that user to just press the previous page button in the browser and access that page again. I want that user to really be logged out at that moment.

Are there any good code examples of this?

Thanks... :o

rachel2004

Have you considered using sessions?

http://us2.php.net/session

flyer

I'm have tested the example on this page:

http://www.devarticles.com/c/a/PHP/PHP-for-Beginners-by-a-Beginners/1/

But I can't get it to work. The first thing that happens when I try to login is a error message saying:

Incorrect login name or password. Please try again.

So I can't even login. I don't know why that happens. I know it should happen if my login or password is wrong but it seems that something makes the code jump that way even the very first time...

rachel2004

I looked at the link, but I wouldn't be able to tel you what is wrong in your code without looking at it. You may have a typo or you may be running an if/else conditional to check for username/password, but are checking for your $_POST variables incorrectly.

If you want to post what you've done, I can take a look and help you troubleshoot the code.

drawmack

to answer your initial questions:

set the pages with a pragma no-chache in html

then do not directly link to any of your pages but instead build a pass through page that simply loads the indicated page passed in the url.

then make each page check to see if it is being called directly and if it is redirect to an error page.

flyer

I found some interesting PHP code on the net about this:

<?php
header('Expires: Mon, 26 Jul 1997 05:00:00 GMT');
header('Cache-Control: no-store, no-cache, must-revalidate');
header('Cache-Control: post-check=0, pre-check=0', FALSE);
header('Pragma: no-cache');
?>