RE: [PHP-DB] authorization idea (good or bad?)

Sounds to me like you want to skip the login if the user is a known user? If this is the case then you may be best to use cookies. A user logins in once, you write the cookie, then you look for the cookies existence on the other pages (use an include file that redirects to the login if the cookie is not found) Its also a good idea to have a log out page that will expire the cookies. This way if the PC is used by different people then the user has a chance to secure their login cookie from being used by others (by destroying it). your script to write the cookie could also be used to check the IP range of the remote user as well to make sure its a valid range (if needed). > -----Original Message----- > From: John Guynn [mailto:John.Guynn@telescan.com] > Sent: Wednesday, 4 October 2000 11:11 PM > To: Php-Db (E-mail) > Subject: [PHP-DB] authorization idea (good or bad?) > > > I'm trying to decide if this is a good idea or not. If I have a > table with > usernames, passwords, and IP addresses I can look at the user's ip address > with $REMOTE_ADDR, see if that matches what's in the database and allow > access to the page and interact with the database (the page I'm wanting to > protect is the page that I use to edit the contents of tables) > but if the IP > address does not match any records ask for a username and > password, recheck > with the "security" table and allow access if it matches an entry. > > Of course this is assuming I know the IP address(es) of the > computer(s) that > would be accessing this database most often. > > Good idea or bad idea? > > John Guynn > >