View Full Version : Password protect web pages questions/help

ricardo.santos
3rd July 2006, 10:50
Hi everyone!

Im buiding a small website for my local club, we would like that members could see their history/info/payments.

What i would like to have would be a login screen that depending on username/password would take the user to their page.

My website is hosted on a host with PHP, MYSQL etc, any help will be greatly apreciated, im new to this stuff.

I was thinking of creating a page for each member and then from the login screen depending on usename/password the user wold be redirected to "his" info, is this the easier way?

Thanks
ricardo.santos
3rd July 2006, 12:13
<!-- TWO STEPS TO INSTALL MULTIPLE USERS:

1. Copy the first code into the HEAD of your HTML document
2. Put the last coding into the BODY of your HTML document -->

<!-- STEP ONE: Copy this code into the HEAD of your login HTML document -->

<HEAD>

<SCRIPT LANGUAGE="JavaScript">



<!-- Begin
function Login(){
var done=0;
var username=document.login.username.value;
username=username.toLowerCase();
var password=document.login.password.value;
password=password.toLowerCase();
if (username=="member1" && password=="password1") { window.location="page1.html"; done=1; }
if (username=="member2" && password=="password2") { window.location="page2.html"; done=1; }
if (username=="member3" && password=="password3") { window.location="page3.html"; done=1; }
if (done==0) { alert("Invalid login!"); }
}
// End -->
</SCRIPT>

<!-- STEP TWO: Paste this code into the BODY of your HTML document -->

<BODY>

<center>
<form name=login>
<table width=225 border=1 cellpadding=3>
<tr><td colspan=2><center><font size="+2"><b>Members-Only Area!</b></font></center></td></tr>
<tr><td>Username:</td><td><input type=text name=username></td></tr>
<tr><td>Password:</td><td><input type=text name=password></td></tr>
<tr><td colspan=2 align=center><input type=button value="Login!" onClick="Login()"></td></tr>
</table>
</form>
</center>



<!-- Script Size: 1.60 KB -->

i found this javascrit online but if someone has betterideas on how to do this......
ricardo.santos
3rd July 2006, 12:16
if someone chooses to view the page source code wont they see the usernames and passwords?
gameplaya15143
6th July 2006, 00:03
if someone chooses to view the page source code wont they see the usernames and passwords?
Thats why you can't do that sort of thing with javascript. There is an almost good method using javascript mentioned on howtocreate.co.uk but the best way is to setup a proper secure server database and stuff (no I don't know how to do that).
Moitah
6th July 2006, 03:00
Something like this:

index.html
<html>
<head>
<title>Login</title>
</head>
<body>
<form method="post" action="validate.php?page=main.html">
<table border="0">
<tr>
<td>User:</td>
<td><input name="user" type="text"></td>
</tr>
<tr>
<td>Password:</td>
<td><input name="pass" type="password"></td>
</tr>
</table><br>
<input type="submit" value="Login">
</form>
</body>
</html>

validate.php
<?php
function redir($location) {
header('location: http://'.$_SERVER['HTTP_HOST'].dirname($_SERVER['PHP_SELF']).'/'.$location);
}

session_start();

if (isset($_REQUEST['user'])) {
$_SESSION['user'] = $_REQUEST['user'];
$_SESSION['pass'] = $_REQUEST['pass'];
}
$user = $_SESSION['user'];
$pass = $_SESSION['pass'];
$page = basename($_GET['page']);
$is_valid = false;

if (($user == 'abc') && ($pass == '111')) {
$is_valid = true;
}
if (($user == 'xyz') && ($pass == '222')) {
$is_valid = true;
}

if (!$is_valid) {
redir('index.html');
return;
}

include(strtolower($user).'.'.$page);
?>

Then you would just make a HTML page for each user, name it "user.main.html" replacing "user" with their username (for example, you would have "abc.main.html" and "xyz.main.html" to go along with the demo usernames in this script).
ricardo.santos
6th July 2006, 10:46
thanks gameplaya15143 and Moitah for your suggestions? So as i thought i cant do it with javascript because someone can always view the page source code.

with PHP someone could guess the "destination page of another member" by having a loook at their page URL.

Can you guys tell me where i could finda tutorial/guide on how to "to setup a proper secure server database "

Once again thanks for your suggestions.
foxyshadis
6th July 2006, 20:53
Shockingly enough, google comes through again (http://www.google.com/search?q=Password+protect+web+pages+php+mysql).
Moitah
6th July 2006, 21:41
I just edited my post above, it's better now. You could do some things like store the users/passwords in a database, and dynamically generate the user pages, but I'm trying to keep it simple.
ricardo.santos
6th July 2006, 22:57
Shockingly enough, google comes through again (http://www.google.com/search?q=Password+protect+web+pages+php+mysql).

Shockingly enough, there are still some people that think we all live in a world where everyone is fluent in English and that we know everything.

if i knew what i was looking for i wouldnt ask for help here.


Thanks for your google results.

Moitah, thanks a lot for your time/help, but anyone that views the souce code can get the passwords? Sorry for being a pain but, i dont consider myself a "genius" and if i can see that flaw i think the vast majority of web users can spot it as well.

You could do some things like store the users/passwords in a database, and dynamically generate the user pages, but I'm trying to keep it simple.

I think thats what im looking for, i searched for guides on how to do something like that but i think my choice of keywords and not knowing what to look for .......
foxyshadis
6th July 2006, 23:07
Well, when you have no idea where to start or what you're doing on a project, plugging some keywords into google is usually the best way to get the basics of something, then you can start searching/asking on forums that specialize in your project area once you have a better grasp of what you need and methods of doing it. Stuff like this gets answered twice a day on Experts Exchange (http://www.experts-exchange.com/) and similar programming sites, even language-specific ones (though my experience is with french sites, not spanish or portugese), where domain experts can help you design something perfectly suited to what you need with a minimum of running down blind alleys.
Moitah
6th July 2006, 23:20
Moitah, thanks a lot for your time/help, but anyone that views the souce code can get the passwords? Sorry for being a pain but, i dont consider myself a "genius" and if i can see that flaw i think the vast majority of web users can spot it as well.
The actual PHP code (the part inside the <?php ?> blocks) is run on the server, and is not sent to the browser. The users won't be able to see the passwords.
ricardo.santos
6th July 2006, 23:27
Thanks

edit: just found THIS (http://www.interlogy.com/products/pmb/index.html) through google by putting the right keywords(thanks guys) is this the kind of "thing" i need?
ricardo.santos
8th July 2006, 15:09
Hi everyone.

While looking at the Cpanel of my host i came across an option "web protect" that will let me protect a directory with a username and password, so im thinking of having a directory called MEMBERS and inside that folder i will create a folder for each member and protect each folder with a username and password.

the only thing im missing now is a login screen with just one option to enter the membership number and then the user is redirected to their directory wherethey will have to put the username and password.

What do you guys think about this "scenery". is it a good system? any Cons i might be missing apart from creating the folders manually

Thanks