Anyway... I'm trying embed a script to handle authentication into my pages... so far I've come up with this system below which does work, but I have no idea if it's secure or if there's a pre-wrapped system for this, or even a totally different way of doing it.
The idea is this code is embedded in every single page of the site (in the header.php file added to each) and will ensure that no matter what page a user is on, they are authenticated every time.
Note: several functions not shown here, such as error() and Encrypt(). Also database operations are handled by an object, Database().
Any thoughts?
Code: Select all
#Login box
if ( !isset( $_SESSION['UserID'] ) ) //If not logged in yet
{
//----------------------------------------------------------
//Things to do in Denver when you're logged out
//----------------------------------------------------------
if ( !ISSET( $_GET['Login'] ) ) //If not trying to log in yet
{
print "
<form action='?Login=True' method='POST'>
Username: <input type='text' name='username' /><br>
Password: <input type='password' name='password' /><br>
<Input Type='Submit' Value='Log In' />
</form>
";
} else { //If in the process of logging on
$AttemptUsername = $_POST['username'];
$AttemptPassword = $_POST['password'];
$Database->Query( "SELECT * FROM Account WHERE Name = '$AttemptUsername'" ); //take a look for the username
if ( $Database->NumRows() ) //if that username even exists
{
$DBRow = $Database->GetRow();
$ActualPW = $DBRow['Password'];
if ( crypt( md5( $AttemptPassword ) , md5( $AttemptPassword ) ) == $ActualPW ) //If password matches
{
$_SESSION['UserID'] = $DBRow['ID'];
$_SESSION['Username'] = $DBRow['Name'];
print "You have succesfully logged in as " . $_SESSION['Username'];
} else {
Error( 3 , "Login -> Invalid Password");
}
} else {
Error( 2 , "Login -> Invalid Username");
}
}
} else {
//----------------------------------------------------------
//Things to do in Denver when you're logged in
//----------------------------------------------------------
if ( !ISSET( $_GET['Logout'] ) ) //If not trying to log out
{
print "Currently logged in as " . $_SESSION['Username'] . "<br>\n";
print "<a href='?Logout=True'>Log Out</a>";
} else { //If trying to log out
unset( $_SESSION['UserID'] );
print "You have now logged out, " . $_SESSION['Username'];
unset( $_SESSION['Username'] );
}
}