Re: RE: registration/login function....

pftt , coding under 200 lines does not mean its better coding than the latter, or more than 200 lines could mean they have rewritten or doubled up things , however the larger the file or the bulkier the code the less efficient its going to be , also u dont even have to write that much code if u are going to use htaccess style auth , but thats not a really friendly approach for hundreds of users to be using is it ? i think like in my authentication class the bulk of the class is classes to checks of every user input. > Bruce, > You can do a whole lot of things with only 200 lines of code. More > code doesn't mean you've got anything more secure, it only means > whoever wrote it didn't know what they were doing. > That my 2 cents. > Hugh > ----- Original Message ----- > From: "Bruce Douglas" <bedouglas@earthlink.net> > To: <php-general@lists.php.net> > Sent: Saturday, May 17, 2003 11:31 PM > Subject: [PHP] RE: registration/login function.... > > >> Paul.... >> >> Thanks for your input. However, what we're looking for is for more >> than 100-200 lines of code...We're looking for something that's pretty > robust... >> and incorporates a number of different security features. Pretty sure >> that Yahoo/Amazon don't have 200 lines of code for their >> registration/login function!!!!! >> >> Be that as it may, we'd also be interested in something "Open Source" >> if > it >> met our needs.. Our concern with writing it ourselves is that we let >> insecure items propagate through the code.... And yes.. we've been >> writing code for years.. so we're familiar with thoroughly testing the >> code... But this is why some basic functionality should be available >> so developers > don't >> have to recreate the wheel from scratch....... >> >> Our $0.02 worth.... >> >> Regards, >> >> Bruce >> bedouglas@earthlink.net >> >> >> -----Original Message----- >> From: Paul Chvostek [mailto:paul+php@it.ca] >> Sent: Saturday, May 17, 2003 9:49 PM >> To: Bruce Douglas >> Cc: php-general@lists.php.net >> Subject: Re: registration/login function.... >> >> >> On Sat, May 17, 2003 at 05:24:50PM -0700, Bruce Douglas wrote: >> > >> > I'm in need of a seriously good Login/Registration application. >> >> Lots of 'em out there, for both PHP and Perl. Rather than searching >> sourceforge and *scripts for "user authentication" scripts, you might >> get further ahead by finding a software package that authenticates the >> way you like, then use that source code as inspiration when you write >> your own. >> >> I use PHP for this sort of stuff. >> >> One method is to mimic .htaccess-style authentication as described on >> the Zend page you've no doubt already looked at. Another way is to >> use session variables. It's pretty straightforward -- the user >> supplies a username and password in a form, which is submitted to a >> script which checks them against the database, and sets a session >> variable that indicates to "secure" scripts that this user is kosher. >> In my case, I set elements in an array with session details for the >> user -- their username, customer ID, language preference, display >> theme, etc. Once the array is set, the login script forwards the user >> to a "secure" page, which checks for the existence of the session >> variables. If they're not set, the "secure" page forwards the user >> back to the login page. The code that does this is in a file >> require()d by each "secure" script on the site. >> >> All in all, the login intelligence I'm using here comprises less than >> 50 lines of PHP code. It was written a few years ago, so I could >> probably tighten it up even more if I felt the urge to rewrite. >> >> The moral here is that if you're developing software, develop the >> software. If you look for example code for every little thing you >> need to write, you'll never get anything finished. If instead of >> searching script archives for what you needed, you had just sat down >> and written it yourself, you'd likely be hours ahead. The search for >> a wheel that matches your precise specifications may very well take >> longer than simply reinventing it. >> >> > The core of this code should really be written so that users don't >> > have > to >> > recreate it as needed...!!!! I'm looking for something "Open >> > Source". >> >> I'm not sure what you mean by "recreate it as needed". And of course, >> any example code you find will likely be open source. Closed source >> things tend not to be distributed, because they're, well, closed >> source. >> >> -- >> Paul Chvostek >> <paul@it.ca> Operations / Abuse / Whatever >> it.canada, hosting and development >> http://www.it.ca/ >> >> >> -- >> PHP General Mailing List (http://www.php.net/) >> To unsubscribe, visit: http://www.php.net/unsub.php >> > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php