one time password

marovios

Hi, does anyone know how to create a one time password login page?, i'm using MySQL and PHP and the idea is to give a user a password that could only be used once, if any user logs in with that password again it should be useless. Is this possible?.

Thanks in advance.

konsu

if you want each user to have a unique password, which is different from all other users' passwords then you would have to have a means to track user passwords and check if a password already exists when a new password is created.

marovios

Hi Konsu.
Mmm, want i want to achieve is that each password could be used just once to access a restricted page. I create the passwords and email them to users, that's not the problem.
The page i want to protect is a special kind of form, and i want each user to access it just once, that's why i want to make it usless after first time login.
It's really hard to find.
Thanks for answering so soon.

konsu

ok, i hope i understand the problem better this time... if a user can access a page just once then you could maintain a list of pages that each user has already seen, and allow to see only the pages not on this list. every time a user sees a page, you add it to this list.

marovios

That's a different point of view, but could be useful as well.

I was looking for a one time password and this solution could also be useful as a user will be allowed to access this special form page just once, even if he uses the same pass.
Quiet good idea!.
Now, what kind of script should i use to get this done?. Any idea?
Many thanks again.

konsu

regarding a one-time password, were you looking for a solution that would require a user to change the password after she logs in? this does not seem to have to do with accessing any page...
if you have a database you can store the page lists in a table.

marovios

I won't let users change the password.
The procedure is as follows: i send a users certain password, this user access a page using that password and fill in the form on that page. That's all. Of course that form is sent to my email address, but that's another story. So, after filling in the form, a new thank you page appears and game is over.
Ok, now is this user wants to access again to my form page, he will not be allowed as he already accessed once. I mean, the password i gave him was already used and is no longer usefull. That way, i'm sure that each user has accessed to my form page just one time.

konsu

i see. so i would have a table in my database, with the association list for my users. for each user, the list would have a page url and the password to access the page with. once the page has been seen, the record is removed from the table. if the table does not have this page's url for this user, she cannot see the page. something among these lines.

bodzan

A user logs in using whatever password (well, sure the one you gave him, but that is not important here) and he gets marked in a database as already been there so next time he tries to return to the page he can't because in database is marked that he was already there...

Well, this solution is only good if users that get your email are already written to the same database as your users or something...

I hope it's clear where I'm getting at...

marovios

Thanks both guys.

Konsu, that's an option.

Bodzan, the mark option is as good as konsu's idea. Thanks you.

I think i'm going with Bodzan's idea as i'm going to use the same form page for all users and i cannot delete the page, i think the mark option is best suitable for this purpose.

How can i achieve that mark thing?, i mean, is there a website that shows how to do that, maybe examples?. I'm a newbie you know.

Thansk both of you, really.

bodzan

...then just ad a field to your current database say visited and make it a type of SET and in a field where you define Length/Values just post '0','1' which means that the value of this fiend can be only 0 or 1...

Then when a visitor loggs in you recognise him through his username and set this value to 1 and next time he visits you don't allow him to see the page by checking whether the value is 1...

If you need any additional info please, feel free to ask...

kburger

When a user successfully logs in using a certain password, why not then change that password in the database to some random string? Wouldn't this be the simplest solution, or am I missing something?

marovios

Bodzan, that sounds great. How can i send a query along with the login transaction so when this user logs in, the field "x" is set to 1 at the same time?.
Newbie question, sorry.

Kburger, your post is also valid for what i try to do. Same dummy question, how do you change the password field to a random password once the user logged in?.

Thanks both.

rikmoncur

my suggestion:

Unique password is stored in a database.
User logs in, fills in form.
On submit, the user is logged out and the password deleted from the database.

marovios

rikmoncur, that's the idea.
How can i achieve that?, how can i delete the password after it's been used? I guess a query should be sent along with the submit action, right?, but how?

bodzan

For my idea:

In the form action script (i.e. script that takes care of the data that is posted through the form) just before you call out the mail() to send the data to your email just perform a query that sets value of the field to 1 like:
UPDATE tbl_name SET visited = 1 WHERE username = 'user_name'
or something simillar...

For kburger's and rikmoncuridea:

On the same place you make the new random password that you put into the database instead of the old one along with the logging user out.

The actual code for this is beter to obtain from kburger or rikmoncurso I won't be stepping on his toes there...

marovios

Ok bodzan. I will try that one.