[RESOLVED] Simple PHP Login

Okay, I want to make a the most simplest login that takes a name and a pass, and if it equals a value, it takes you to just a page where can approve or deny submissions. I know how to do the forms and $_POST and stuff.

Now, can I have some secret page that is restricted to clients, and the script gets that page and displays it? Like file_get_contents, or something?

Um... yah.

Here is a simple authentication example.

PHP Code:

---

<?php
function login(){
  header('WWW-Authenticate: Basic realm="Administration"');
  header('HTTP/1.0 401 Unauthorized');
  echo '<font face="arial" size="3"><b>Error 401: Access Denied!</b></font>';
  exit;
}

if(!isset($_SERVER['PHP_AUTH_USER'])){login();}
else{
  if(
    $_SERVER['PHP_AUTH_USER'] == 'admin' &&
    md5($_SERVER['PHP_AUTH_PW']) == 'someMD5hash'
  ){
    unset($_SERVER['PHP_AUTH_USER']);
    echo '<font face="arial" size="3"><b>Error 401: Access Denied!</b></font>';
  }
  else{login();}
}
?>

---

So what is the 'someMD5hash'? Is that the password (i think it is)?

So I change that to whatever I want then?

Quote:

---

Is that the password (i think it is)?

---

It's a md5 hash code of a normal text password.
You can get a hash of a text by running md5("myTextPassword");
Since hash of the same string is the same number always you can compare the the value saved in a database for ex. with the value from the input form.

One more thing: hash codes are irreversible, so you cannot use them to encrypt data that you will need to transform back. For more info google for md5.

Why is the $_SERVER["PHP_AUTH_PW"] encapsulated in the md5()? Is that a security measure for something?

Couldn't you have this?

PHP Code:

---

<?php
if(!isset($_SERVER['PHP_AUTH_USER'])){login();}
else{
  if(
    $_SERVER['PHP_AUTH_USER'] == 'myname' &&
    $_SERVER['PHP_AUTH_PW'] == 'mypass'
  ){
    unset($_SERVER['PHP_AUTH_USER']);
    echo '<font face="arial" size="3"><b>Error 401: Access Denied!</b></font>';
  }
  else{login();}
}
?>

---

It is a security precaution. If you don't use an MD5 hash, then anyone who sees your code will have compromised your password.