Forum Moderators: coopster

Message Too Old, No Replies

login.php, are 3 pages really necesarry?

loging in with a single file

         

punisa

12:18 pm on Apr 18, 2009 (gmt 0)

10+ Year Member



While constructing my login page, which I intend to do as secure as possible, I've read many examples and tutorials which basically split the whole login/registration process down to several files, such as:
login.php
checklogin.php
register.php
logout.php

Is this process really necessary?
Can I just make form take action on "_self" and have at top of my document "require_once '../../login_details.php';" with all the details?

BTW, my login_details.php is placed outside of root folder.

inside it I have:


if(isset($_POST['register'])){
// do stuff...
}
if(isset($_POST['login'])){
// do stuff...
}
if(isset($_POST['logout'])){
// do stuff...
}

Is this method bad?

whoisgregg

1:38 pm on Apr 18, 2009 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Nothing wrong with that method at all. :)

Lots of tutorials break things down like that because their target audience are folks that are completely new to PHP. For most people, having things split out make it easier to understand (and debug when things don't work!).

rocknbil

2:27 pm on Apr 18, 2009 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I would change only two things - well several things, but one idea and a second:


if(isset($_POST['register'])){
// do stuff...
}
if(isset($_POST['login'])){
// do stuff...
}
if(isset($_POST['logout'])){
// do stuff...
}

It's entirely possible that as some point, for example, two of any given variable may be present at the same time. So in the above, you would get responses from both conditions.

Use either else if,

if(isset($_POST['register'])){
// do stuff...
}
else if(isset($_POST['login'])){
// do stuff...
}
else if(isset($_POST['logout'])){
// do stuff...
}
else { // default }

or a switch (but see second comment:)

$action = (isset($_POST['action']))?$_POST['action']:'';

switch ($action) {
case 'register':
// create account
case 'login':
// log in
case 'logout':
// clear cookies, delete session
default:
// oops
}

Second, of course, never directly use input without cleansing.