Writing PHP login & using MySQL db

I'm almost there but need some help :)

[javacup]

I want to have a client access area, where *I* give my client a username & password from my mySQL database that resides on my server. When a particular client logs in they should be directed to *their* directory to view some html files.

I have set up my form, my database, & my login.php. I am not sure where to put code for each particular client's redirect? Does it go in my database? or my login.php?

thanks for any suggestions,
j.

[rubenski]

Hi. I suggested the .htaccess / .htpasswd option to another user in this thread. Perhaps you want to take a look there: [webmasterworld.com...]

This would work like:
Login to /restricted_area --> default page index.php is accessed --> index.php decides where user is taken based on $REMOTE_USER (their username).

I like this solution because it gives good security for very little effort.

If you don't want to use .htaccess/.htpasswd you can still do more or less the same. Just submit the login form to a php file that decides to which URL the user is taken based on his/her username.

[Sanenet]

How secure do you want this system to be? You could (easiest way) create subdirectories based on usernames, or random characters.

So, either you put some code in your login.php like this (pseudocode):
URL Redirect to mysite.com/username

Or, create a random string that is the name of their directory and store it in the DB along with the username, and (pseudocode):
URL Redirect to mysite.com/user-random-string-which-is-also-their-directory

Either way, remember that anybody knowing the directory name can access the subdirectory if they know the directory name. So, you need to include in each file called from the directory a bit of code that checks to see if the user is logged in. Or, you setup .htaccess security from each directory on the server side. (This can be a pain in the b**t if you have lots of users, want an automated signup procedure, etc).

[javacup]

>>This would work like: Login to /restricted_area --> default page index.php is accessed --> index.php decides where user is taken based on $REMOTE_USER (their username).<<

Yes, this is something that I would like but I'm having difficulty understanding how to do this. How is this shown in my .php file?

[rubenski]

@Sanenet:

"Either way, remember that anybody knowing the directory name can access the subdirectory if they know the directory name"

I think this is not true when you let users login at /clientlogin/ and forward them to /clientlogin/$username as the .htaccess and .htpasswd files in /clientlogin/ will protect dubdirectories too, right? Or am I wrong?

[rubenski]

@Javacup:

Creating a login like this is actually quite simple.

Simply create the directory you want to protect, upload a .htaccess and .htpasswd file to that directory.

The .htaccess file could look like this:

AuthUserFile /usr/local/psa/home/vhosts/yourdomain/htdocs/yoursecretdirectory/.htpasswd
AuthType Basic
AuthName PasswordProtectedArea
require valid-user

AuthUserFile is the server path to your .htpasswd file. You can usually find the server path in your host's FAQ.

The .htpasswd contain each user on a separate line.
Like this

username:password

The password should be encrypted. You can get your password encrypted on a lot of places on the web. search for "password encryptor". So, one line of your .htaccess file just look like username:alotofbogus

username:kEFOJmmoWOFjmDlSlk

Right. So far for the login part. Once your users are authenticated they will be automatically taken to index.php. Create your index.php and just use "echo" to write an HTML document with a meta-refresh tag to /clientlogin/$REMOTE_USER.

You should create the /clientlogin/$REMOTE_USER dirs beforehand. You could let PHP write if it is not yet there, but's I think this should het you started.

[javacup]

rubenski,
thanks for the info. Just a few questions about it:

- Doing it this way means I don't need to use an mySQL database, right?
- I've already created my html file containing my login form. How do I call that?
- In my .php file would I just use the header location: /clientlogin/$REMOTE_USER to send the user to the right place?

Thanks again for your help!

[azornoz]

Hi all, in apache it's not $Remote_User but $_HTTP_SERVER["PHP_AUTH_USER"] the var that keeps the login name (what a bad surprise that phpinfo() shows the passwd with $_HTTP_SERVER["PHP_AUTH_PWD"], sure this method is not secure,;D).

Also the header needs some php style:

<?
header('refresh: 3;url=/'.$_SERVER["PHP_AUTH_USER"].'/index.php');
?>

Where / it's the DocumentRoot of the host u r accessing and 3 r seconds.

Could anybody put here a link about the mysql-php secure method for login-storing the encrypted pwds?.
Thanks.

[javacup]

<?
header('refresh: 3;url=/'.$_SERVER"PHP_AUTH_USER"].'/index.php');
?>

Doesn't seem to work for me. I get a successful login but in the address line I can see that the code doesn't direct me to my user directory. (the PHP auth user)

any ideas what's wrong?

[coopster]

Well, syntax-wise you're missing an opening brace:

header('refresh: 3;url=/'.$_SERVER["PHP_AUTH_USER"].'/index.php');

[javacup]

Oops, my fault during copy/paste. It was correct in my code though. I just don't understand it. I can see that once I hit submit it trys to direct me to the appropriate directory and I end up at [wwWebmasterWorldebsite.com...]

Why isn't it inserting my username between the two slashes?

[greenfish]

Hi I am new to PHP but am trying to develop a similar portal login where the user 'someuserA' logs in at www.somesite.com and gets redirected to www.somesite.com/someuserA.

I have developed a basic authentication system using sessions and mysql database. How can I implement a facility to ensure that someuserA can only access the files in www.somesite.com/someuserA while someuserB can only access files in www.somesite.com/someuserB?

Thank you!