https: What is the trick?

leatherback

Hey All,

I am building a web-based interface to manage website content. This will all be done online. I would like to use secure connections for the transfer of login information. How would I get that done?

I have no clue as to securing connections, and google has left me clueless too. Am I missing something simple? ANybody has a tutorial, or time to write how to go ahead?

psnb

Try this with some modifications.

<?php
if (isset($COOKIE['admin'])) {
echo "Welcome";
}
else if (isset($POST['submit'])) {
$connection = mysql_connect('localhost', 'user', 'pass');
$db = mysql_select_db("database");
$username = $POST["username"];
$password = $POST["password"];
$result = MYSQL_QUERY("SELECT * from admin WHERE username='$username'and password='$password'")
or die ("Name and password not found or not matched");
$worked = mysql_fetch_array($result);

$username = $worked[username];
setcookie('admin',$username);
echo "<META HTTP-EQUIV=Refresh CONTENT='3; URL=$PHP_SELf'>";
}
else {
echo "<form action=$_SERVER['PHP_SELF'] method=POST>
<b>Username:</b> <input type=text name=username size=40><br>
<b>Password:</b><input type=text name=password size=40><br>
<input type=submit name=submit value=Send></form>";
}

leatherback

Hi psnb,

Thanks for the reply. But I have no problem at all building a userlogin & management tool.

What I am lookgin for, is information on how to make the connection secure when transmitting sensitive information, such as login details. So I need to know how to make a https connection, instead of http.

Anyone?

psnb

In the form try this

planetsim

Originally posted by leatherback
Hi psnb,

Thanks for the reply. But I have no problem at all building a userlogin & management tool.

What I am lookgin for, is information on how to make the connection secure when transmitting sensitive information, such as login details. So I need to know how to make a https connection, instead of http.

Anyone?

J.

Ive never actually worked with HTTPS connections, but have you got an SSL Certificate? Have you also looked into OpenSSL?

leatherback

Hi planetsim,

Although I do not have a ssl certificate, I am sure the university (for which I am building a websitre section) has a certificate. But I am not sure how this whoile thing works. Getting the right parts together ios the next step!

You want to explain a bit further on how to go about on this/

ab4net

you just have to install the Secure Certificate on a Domain name, after that, you can set up Secure pages : some thing like : [url]https://[/url] ..... etc ...

so, when you want to secure the username and password, you have to secure the followin URL's:

1- secure the URL of the page contains the form of information (username and password) because it'll have the info, and post them
2- secure the handler, which means the page which form posts data into ... because it'll also have the information ...

while using the SSL is securing (encrp.) your data, so it is secured ...

now, how to install SSL is some thing else, and i think once you are doing a project for some one, have already the SSL, so just you have to ask them what they can encode for you, what pages, and you you do nothing more than using the (s) after http and nothing more in the coding ...

i have tried it this way and it works fine ..

hope this is helpful. ..

planetsim

Originally posted by leatherback
Hi planetsim,

Although I do not have a ssl certificate, I am sure the university (for which I am building a websitre section) has a certificate. But I am not sure how this whoile thing works. Getting the right parts together ios the next step!

You want to explain a bit further on how to go about on this/

J.

Well depending on how you get the certificate whether its from the university or yourself buying one.

Once you have the certificate, if you bought it you will be given installation instructions and more than likely other things like how to use it etc.

[man]OpenSSL[/man] can be used with the Certificate.

You'll probably get more help from someone other than myself who has absolutely no experience with SSL Certificates, HTTPS.