password protect using sessions

[Anon]

I'm trying to require a user to submit a password to allow access to a series of web pages. Right now using the appropriate "username" and "password" I can get from the "login" page to the "welcome" page where a user is congratulated by name for successfully loggin in. This uses sessions, but this is where I get stuck. How do I move to a third page passing information without having the user re-enter "username" and "password"? What would my algorithm look like? Is there a better way than using sessions? What am I leaving myself open to?

[jeremy_brooks]

If you are databasing the username/pass info (which I assume you are) you will want to open a session storing the username as the session variable, but ONLY if the username/password combo has been successfully authenticated. You can then use the session var to track usage, check permissions, etc

May not be 100% applicable, but I posted some nifty user auth and group permission scripts in the PHPBuilder Code Library (odbc_group_check)...May give you some ideas of how to go about it

[Anon]

How do I tie each of the following pages into the same session? Or asked differently, how do I validate the user has access to each of the pages?

Downtown.

[jeremy_brooks]

1. write a script to give a login page, including session timeout catches and expired/modified cookie checks; if the user gets logged successfully, have the script open a session using the username as a session variable. Use this script as a require() on all pages you want to protect.

2. Open a session at the top of each protected page so each time the page is loaded it will validate the user.

3. To open certain pages to access only from certain ID's, you can use the session variable(the username) to ping the database and see if that person has access to the page

for samples: http://www.phpbuilder.com/snippet/detail.php?type=snippet&id=169

[Anon]

I'm using the files:

style.inc
group_check.inc
auth_test.inc

I'm calling these files using a page that consists solely of the script:

<?
$permit = "45shp";

require('C:\Apache\inc\auth_test.inc');
require('C:\Apache\inc\group_check.inc');

session_start();
?>

But I get errors regarding the variables: "baview_auth", and "this_user". Can you tell me more about how these are being used.

I'm using MySQL, PHP4, and Apache on a Win32 Machine.

Way Downtown.

[Anon]

http://www.phpbuilder.com/columns/tim20000505.php3

[jeremy_brooks]

baview_auth is the name of the cookie that gets set if the user has logged in OK...(BAView is the name of the application I originally wrote this for)

$this_user is the name of the text field on the login form that subsequently gets used as the variable to authenticate the user and verify the cookie, etc

Glad to see someone is giving this script a shot; it works great for us, but we use it on an intranet. I am also curious to see how (if you decide to use this) you will modify the odbc calls for MySQL

Let me know if you need any additional help getting it set up

[Anon]

What does the following code from group_check.inc do?

while (mysql_fetch_row($row)); {
$db_GID = odbc_result($row, 44);
}

I'm getting an error that looks like:

Warning: Unable to jump to row 44 on MySQL result index 2

Also, can I get a description of the database associated with these files?

As I move this into MySQL, I'm having to guess at the database's structure.

Thanks,

DownTown.

[jeremy_brooks]

column 44 is the gid field--that is the one that sets user-level permissions (i.e., username jbrooks has access levels 3, 9, and e, so the db entry is 39e)...

here is a brief detail of the db fields you will/may need (I just left out some of our internal stuff you won't need):

col1 = id int(4) autonumber record id
col3 = LastName varchar(30) Last Name
col4 = FirstName varchar(30) FIrst Name
col5 = MI varchar(1) middle initial
col16 = username varchar(8) user login
col37 = password varchar(40) MD5 hash of password
col38 creation_date smalldatetime date of account creation
col39 current_login_date smalldatetime current login date/time
col40 last_login_date smalldatetime previous login date/time
col41 last_change smalldatetime last password change
col42 current_IP varchar(15) current IP
col43 string varchar(50) MD5 'secret' to verify cookie
col44 gid varchar(36) group id for per-page-permisions, integer 0-9, alpha a-z

whew Think I'll add that to the file so I don't have to write it again

Let me know if you need anymore help, and when you do get it working, please post it and send me a link!