={ Advocated }= said:
Yea, i can do that already, but ive got a form, with 2 text areas for
login/pass so i still need a script
Firstly, I'll point out that it is *much* easier to use HTTP
authentication. It means that you don't get a nice custom login screen,
but it is very easy and very reliable.
If you *do* feel the need for a non-HTTP authentication system the idea is
not to difficult.
The page that receieves the data submitted by the login form should
call the following function. If it returns true, then serve up the
protected page. Otherwise, serve up a page saying something like "you
entered the wrong user name or password"
function checkpwd_and_set_cookie()
{
$username = get_value_from_http_post_data('username');
$password = get_value_from_http_post_data('password');
$correctpassword = get_password_from_database($username);
if ( not ($password == $correctpassword) )
{
return false;
}
else
{
$salt = random_string_of_text();
$ticket = md5sum($username . $salt . $password);
set_cookie('username', $username);
set_cookie('salt', $salt);
set_cookie('password', $password);
return true;
}
}
For every other page that is protected, the script should call the below
function checkpwd(). If the function returns true, then serve up the page.
Otherwise, serve up a page saying something like "please login to view
this page".
function checkpwd()
{
$username = get_value_from_cookie('username');
$salt = get_value_from_cookie('salt');
$ticket = get_value_from_cookie('ticket');
$password = get_password_from_database($username);
$validticket = md5sum($username . $salt . $password);
if ($validticket == $ticket)
{
return true;
}
else
{
return false;
}
}
It should be reasonably obvious what the functions get_password_from_database,
get_value_from_cookie, get_value_from_http_post_data, set_cookie and md5sum do.
The '.' operator is for concatenation.
It should be quite secure, in that the password isn't kept in the cookie. Do it
over HTTPS for better security though.
Let me know if you have trouble figuring out how this works.
