Re: RE: registration/login function....

Bruce, You can do a whole lot of things with only 200 lines of code. More code doesn't mean you've got anything more secure, it only means whoever wrote it didn't know what they were doing. That my 2 cents. Hugh ----- Original Message ----- From: "Bruce Douglas" <bedouglas@earthlink.net> To: <php-general@lists.php.net> Sent: Saturday, May 17, 2003 11:31 PM Subject: [PHP] RE: registration/login function.... > Paul.... > > Thanks for your input. However, what we're looking for is for more than > 100-200 lines of code...We're looking for something that's pretty robust... > and incorporates a number of different security features. Pretty sure that > Yahoo/Amazon don't have 200 lines of code for their registration/login > function!!!!! > > Be that as it may, we'd also be interested in something "Open Source" if it > met our needs.. Our concern with writing it ourselves is that we let > insecure items propagate through the code.... And yes.. we've been writing > code for years.. so we're familiar with thoroughly testing the code... But > this is why some basic functionality should be available so developers don't > have to recreate the wheel from scratch....... > > Our $0.02 worth.... > > Regards, > > Bruce > bedouglas@earthlink.net > > > -----Original Message----- > From: Paul Chvostek [mailto:paul+php@it.ca] > Sent: Saturday, May 17, 2003 9:49 PM > To: Bruce Douglas > Cc: php-general@lists.php.net > Subject: Re: registration/login function.... > > > On Sat, May 17, 2003 at 05:24:50PM -0700, Bruce Douglas wrote: > > > > I'm in need of a seriously good Login/Registration application. > > Lots of 'em out there, for both PHP and Perl. Rather than searching > sourceforge and *scripts for "user authentication" scripts, you might > get further ahead by finding a software package that authenticates the > way you like, then use that source code as inspiration when you write > your own. > > I use PHP for this sort of stuff. > > One method is to mimic .htaccess-style authentication as described on > the Zend page you've no doubt already looked at. Another way is to use > session variables. It's pretty straightforward -- the user supplies a > username and password in a form, which is submitted to a script which > checks them against the database, and sets a session variable that > indicates to "secure" scripts that this user is kosher. In my case, I > set elements in an array with session details for the user -- their > username, customer ID, language preference, display theme, etc. Once > the array is set, the login script forwards the user to a "secure" > page, which checks for the existence of the session variables. If > they're not set, the "secure" page forwards the user back to the login > page. The code that does this is in a file require()d by each "secure" > script on the site. > > All in all, the login intelligence I'm using here comprises less than > 50 lines of PHP code. It was written a few years ago, so I could > probably tighten it up even more if I felt the urge to rewrite. > > The moral here is that if you're developing software, develop the > software. If you look for example code for every little thing you need > to write, you'll never get anything finished. If instead of searching > script archives for what you needed, you had just sat down and written > it yourself, you'd likely be hours ahead. The search for a wheel that > matches your precise specifications may very well take longer than > simply reinventing it. > > > The core of this code should really be written so that users don't have to > > recreate it as needed...!!!! I'm looking for something "Open Source". > > I'm not sure what you mean by "recreate it as needed". And of course, > any example code you find will likely be open source. Closed source > things tend not to be distributed, because they're, well, closed source. > > -- > Paul Chvostek <paul@it.ca> > Operations / Abuse / Whatever > it.canada, hosting and development > http://www.it.ca/ > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php >