User Authentication and Sessions

[Jonnie]

I want to build a secure user authentication page that uses mySQL to
verify user, password, and access rights, where admins see everything
and full acess, while others see only links and pages their 'group' has
access to.

I am pretty new to PHP and this will be a great learning project, so
any guidance on where to start would be welcome. I am looking at a few
tutoriqals now, but most of them seem to focus on protecting a whole
site or single page, I want the entire thing to be displayed
dynamically depending on access rights. A good tutorial and a push in
the right direction would be just about perfect.

Hope I provided enough info, I will more thanlikely pick your brains
again :-), thanks


Jonnie

[fiziwig]

Re: User Authentication and Sessions

A few examples to get you started:

At login screen:

.... ($uname and $upass from a <form>)...

$query="SELECT user_id, user_status FROM users WHERE
user_name='$una me' AND
password='$upas s'";
$result=mysql_q uery($query);
if($result) {
if ( mysql_num_rows( $result) == 0 ) {
$err[]='Username or password is incorrect.';
} else {
$row=mysql_fetc h_array($result , MYSQL_ASSOC); // get status
session_start() ; // send seession_id cookie to user
$_SESSION['username'] = $uname;
$status = $row[ 0 ];
$_SESSION['status'] = $status;
$url='http://' . $_SERVER['HTTP_HOST'] .
dirname($_SERVE R['PHP_SELF']);
if ((substr($url, -1) == '/') OR (substr($url, -1) == '\\')){
$url = substr($url,0,-1); // Get full pathname
}
$url .= '/index.php'; // go back to index page, now logged in
header("locatio n: $url"); // bail out to the redirect page
exit(); // and stop executing this script
......

At top of page that requires a certain level to view:
Ever page now has access to the user's status via the $_SESSION array.

session_start() ; // send session_id cookie to user
if(isset($_SESS ION['username'])) {
$uname=$_SESSIO N['username'];
$ustatus= $_SESSION['status'];
} else {
$ustatus=0;
if ( $ustatus >= $this_page_leve l ) { // some minimum status level to
view this page
// required to be logged in and with status high enough to
// view this screen. If not redirect to another page
$url='http://' . $_SERVER['HTTP_HOST'] .
dirname($_SERVE R['PHP_SELF']);
if ((substr($url, -1) == '/') OR (substr($url, -1) == '\\')){
$url = substr($url,0,-1); // Get full pathname
}
$url .= '/login.php?'; // redirect, for example, to the login page
header("locatio n: $url"); // bail out to the redirect page
mysql_close();
exit(); // and stop executing this script
}

Or, if you simply want a link to be invisible when the users status is
not high enough:

if ($ustatus >= $min_status)
echo '<a href="someplace .php">You can't see me.</a>';

--gary

[Jerry Stuckle]

Re: User Authentication and Sessions

Jonnie wrote:[color=blue]
> I want to build a secure user authentication page that uses mySQL to
> verify user, password, and access rights, where admins see everything
> and full acess, while others see only links and pages their 'group' has
> access to.
>
> I am pretty new to PHP and this will be a great learning project, so
> any guidance on where to start would be welcome. I am looking at a few
> tutoriqals now, but most of them seem to focus on protecting a whole
> site or single page, I want the entire thing to be displayed
> dynamically depending on access rights. A good tutorial and a push in
> the right direction would be just about perfect.
>
> Hope I provided enough info, I will more thanlikely pick your brains
> again :-), thanks
>
>
> Jonnie
>[/color]

Or simply use mod_auth_mysql from www.sourceforge.net.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attgl obal.net
=============== ===

[R. Rajesh Jeba Anbiah]

Re: User Authentication and Sessions

Jonnie wrote:[color=blue]
> I want to build a secure user authentication page that uses mySQL to
> verify user, password, and access rights, where admins see everything
> and full acess, while others see only links and pages their 'group' has
> access to.[/color]
<snip>

Possibly
1. <news:111099185 5.257652.244240 @z14g2000cwz.go oglegroups.com> (
http://groups.google.com/group/comp....0fad0eef59415a )
2. http://phpgacl.sourceforge.net/

--
<?php echo 'Just another PHP saint'; ?>
Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com/