Forum Moderators: coopster
I threw together a quick-n-dirty PHP password protect for someone who asked me for one, but I then became aware that there may be a vulnerability associated with working like this that might give someone unauthorised access?
Security isn't really that much of an issue, but it'd be nice to know for the future so I can make a workaround.
<html>
<head></head>
<body>
//if bit
<?php
$username = "username";
$password = "password";
if ($_POST['txtUsername']!= $username ¦¦ $_POST['txtPassword']!= $password) {
?>
<form name="form" method="post" action="<?php echo $_SERVER['PHP_SELF'];?>">
Username: <input type="text" name="txtUsername" />
Password: <input type="password" name="txtPassword" />
<input type="submit" value="Submit" />
</form>
//else bit
<?php
}
else {
?>
<p> passworded bit </p>
<?php
}
?>
</body>
</html>
Thanks
-- James.
If someone gets their hands on the raw PHP though, then they get your password. To fix that you could generate a crypt [php.net] for the password string and compare it with the crypt of what is entered.
Or, if you have access to .htaccess you can use that to create a password-protected directory. Anything in the directory is then protected.
If you don't have a secure key (https) then the password is transmitted as plain text in both cases and can (in theory) be intercepted on any server between the browser and the host. Probably not a big issue here.
Anyway, given that the password and the information you want to protect are in the same file the point is moot ;)
Maybe CHMOD could be used to block access too?
both of these situations make it difficult to call through a browser but easy to include or query
the moment you think you have taken enough precautions and that your site is secure, give up because you just lost.
there is always a way around everything
the #1 rule to security is nothing is ever 100% secure. The process of increasing and streamlining your security is a constant process.
How can someone get around it?
I don't know, want me to try? ;)
there is always someone smarter than you out there and they may just want what you have so I always think of security and make adjustments to my scripts/systems.
So you move the passwords above the root of the site and put an include in the file.
why not? security is better and it will take a few seconds to change.
the best authentication systems involve the server sending a unique random hash to each browser loading the login page, which is then combined client-side (with JavaScript, for instance) and an MD5 (preferably SHA1) hash of the combined string (random session-unique hash, and password) is returned to the server by your login form.
even an unscrupulous ISP, or proxy server with access to your full HTTP headers couldn't utilise the data, each session is unique, requires a unique login. I've been messing about with this recently for my site's admin page.
password files always as includes, yes, even inside a web directory is okay (some folk ahve no choice), so long as your file permissions are tight. Using .ht_something for the password fiename gives you an extra layer of protection. or you can add some .htaccess to ignore requests for whatever filename you choose.
anyway, I'm supoosed to be winding down..
zzz..
;o)
(or
