html - Proper php login authorization -
i editing old page , needed authorized access page. right code in php , have set 1 username , 1 password can bypass sign in screen , if authorization successful, login redirects me "secret" page.
but, if knows url "secret" page" (for example ..../secrets/secret1.php), can bypass login screen. best solution in case?
i tried hiding php extension editing .htaccess, didn't work. don't want hide address bar entirely.
in login page can set session of current user grant access pages needs authorization.
for example if have log-in page like:
<?php /* log-in */ // declare username , password $my_username = "admin"; $my_password = "rootstemleaves"; // declare page redirect $secret_page = "../secrets/secrets1.php"; // set initial value $proceed = 0; // check if username empty if(empty($_post['username'])){ // tell user username empty echo "you need put username!"; // set not proceed $proceed = 0; } else { // set proceed $proceed = 1; } // check if empty password if(empty($_post['password'])){ // tell user password empty echo "you need put password"; // set not proceed $proceed = 0; } else { // set proceed $proceed = 1; } // proceed if checked ok if($proceed == 1){ // check if username not same if($username !== $my_username){ // tell user entered wrong username echo "wrong username!"; } else { // check if password not same if($password !== $my_password){ // tell user entered wrong password echo "wrong password"; } else { // redirect page header("login: $secret_page"); } } } ?> <!doctype html> <html> <h1>log-in</h1> <form method='post'> <input type='text' name='username' placeholder='username'><br> <input type='password' name='password' placeholder='password'><br> <br> <button type='submit'>submit</button> </form> </html> you can add session_start(); begin session , set user logged in can access secret pages if authorized.
so log-in page should more this:
<?php /* log-in new!!! */ // important tell php start session @ beginning of file session_start(); // declare username , password $my_username = "admin"; $my_password = "rootstemleaves"; // declare page redirect $secret_page = "../secrets/secrets1.php"; // check if user logged in or not. if(!empty($_session['logged_in'])){ // redirect page header("location: $secret_page"); } // set initial value $proceed = 0; // check if username empty if(empty($_post['username'])){ // tell user username empty echo "you need put username!"; // set not proceed $proceed = 0; } else { // set proceed $proceed = 1; } // check if empty password if(empty($_post['password'])){ // tell user password empty echo "you need put password"; // set not proceed $proceed = 0; } else { // set proceed $proceed = 1; } // proceed if checked ok if($proceed == 1){ // check if username not same if($username !== $my_username){ // tell user entered wrong username echo "wrong username!"; } else { // check if password not same if($password !== $my_password){ // tell user entered wrong password echo "wrong password"; } else { // set session !!! $_session['logged_in'] = true; // redirect page header("login: $secret_page"); } } } ?> <!doctype html> <html> <h1>log-in</h1> <form method='post'> <input type='text' name='username' placeholder='username'><br> <input type='password' name='password' placeholder='password'><br> <br> <button type='submit'>submit</button> </form> </html> look @ end of logic going redirect user, set $_session['logged_in'] = true; because use check later in pages need authorization.
so in secret page need add top if user logged in:
<?php /* secret page */ // start session (important!) session_start(); // login page $login_page = "login.php"; // check if user logged in if($_session['logged_in'] !== true){ // redirect login page prevent unauthorized access header("location: $login_page"); } ?> also if need logout user, make logout.php code:
<?php /* log-out */ // start session (important!) session_start(); // login page $login_page = "login.php"; // destroy session! session_destory(); // finally, redirect user log-in page in case wanted log-in again header("location: $login_page"); ?> so in hidden page add <a href="logout.php">logout</a> log-out.
make sure though in future use database store log-in credentials , hash , salt password (never store password in plain text ever!)
hope helps
Comments
Post a Comment