RE: [PHP-DB] authorization idea (good or bad?)

I tend to agree with the fellow that responded. Anyone who can access the "registered" computers can gain access to the site, whether they were intended to or not. You *could* narrow it down by having users who acces the site from those computers enter a system wide password, or enter the password associated with their IP. If the login is coming from another computer not registered, then they must enter a login name and password. Just my two cents :) Sean Finkel alarion@planetunreal.com -----Original Message----- From: John Guynn [mailto:John.Guynn@telescan.com] Sent: Wednesday, October 04, 2000 9:43 AM To: Php-Db (E-mail) Subject: RE: [PHP-DB] authorization idea (good or bad?) At this point dynamic IP's are not a concern. I can only think of 2 to 4 machines that would have "IP address authentication" and any other machine that hits the page would be forced to use username and password. Right now I've got security through obscurity so anything is better than what I have...I was just considering a more elegant solution than requiring a username/password when I KNOW (ok...99% sure) the IP addresses of the few machines that should be accessing this page. And yes, it is across the Internet. John Guynn -----Original Message----- From: Stefan Siefert [mailto:s.siefert@global-media.de] Sent: Wednesday, October 04, 2000 8:39 AM To: John Guynn Subject: AW: [PHP-DB] authorization idea (good or bad?) >I'm trying to decide if this is a good idea or not. If I have a table with >usernames, passwords, and IP addresses I can look at the user's ip address >with $REMOTE_ADDR, see if that matches what's in the database and allow >access to the page and interact with the database (the page I'm wanting to >protect is the page that I use to edit the contents of tables) but if the IP >address does not match any records ask for a username and password, recheck >with the "security" table and allow access if it matches an entry. Well I think the idea is pretty good but what's about dynamic IP's? Also I think pwd an d login are the better way to protect a site, because everybody how gain access to the registered computers can visit the site (because the IP - Adress the computer uses is a registered one) It it is really important to protect the site use a password you create with more than 12 char... >Of course this is assuming I know the IP address(es) of the computer(s) that >would be accessing this database most often. >Good idea or bad idea? Well not bad, but good? -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-db-unsubscribe@lists.php.net For additional commands, e-mail: php-db-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net