RE: [PHP] RE: registration/login function....

Hey... Thanks for the responses.... Here are some of the requirements that I imagine a good Login/Registration/User Authentication app should have: 1) User/Passwd Form 2) Session Based 3) Database driven 4) Modular design 5) Key pages reside outside/beyond the user's ability to mofify 6) All input vars are thoroughly checked/tested to ensure they are of the correct type/length/etc... 7) Regex checking is performed 8) Thorough checking/testing of all SQL queries as well as all input to any SQL queries 9) Open to public testing/checking 10) Uses session vars to limit page access 11) Handles users/groups of various access rights 12) Admin Control Panel/Function 13) Handles/Checks the following conditions: IP Address Checking/Deny Denies User Name usage from multiple IPs within a given amount of time 14) Minimal usage of global vars These are just a few and a first pass.... feel free to add your own. What I'm getting at, is that this code is normally written, kindof works, and is implemented.... We're looking for something a little better... Thanks Bruce bedouglas@earthlink.net -----Original Message----- From: Frappy John [mailto:frappyjohn@gulfbridge.net] Sent: Sunday, May 18, 2003 9:41 AM To: Bruce Douglas; php-general@lists.php.net Subject: Re: [PHP] RE: registration/login function.... Bruce-- > I'm in need of a seriously good Login/Registration > application. Any of the open source content mangagement systems will have this capability. > This will form the basis of the user > authenticatino portion of the site I'm developing. . . . > The language could be either PHP/Perl. I would choose your overall platform first, then look for a registration/authentication system using that platform. > Thanks for your input. However, what we're looking for is > for more than 100-200 lines of code... Please see: http://pespmc1.vub.ac.be/OCCAMRAZ.html > We're looking for > something that's pretty robust... and incorporates a > number of different security features. The only requirements you've given us are "registration/authentication". Authentication implies authenticity, which implies security. Do you have additional security reqirements? If so, what are they? --Frappy If you have specific On Sunday 18 May 2003 02:31 am, Bruce Douglas wrote: > Paul.... > > Thanks for your input. However, what we're looking for is > for more than 100-200 lines of code...We're looking for > something that's pretty robust... and incorporates a > number of different security features. Pretty sure that > Yahoo/Amazon don't have 200 lines of code for their > registration/login function!!!!! > > Be that as it may, we'd also be interested in something > "Open Source" if it met our needs.. Our concern with > writing it ourselves is that we let insecure items > propagate through the code.... And yes.. we've been > writing code for years.. so we're familiar with > thoroughly testing the code... But this is why some basic > functionality should be available so developers don't > have to recreate the wheel from scratch....... > > Our $0.02 worth.... > > Regards, > > Bruce > bedouglas@earthlink.net > > > -----Original Message----- > From: Paul Chvostek [mailto:paul+php@it.ca] > Sent: Saturday, May 17, 2003 9:49 PM > To: Bruce Douglas > Cc: php-general@lists.php.net > Subject: Re: registration/login function.... > > On Sat, May 17, 2003 at 05:24:50PM -0700, Bruce Douglas wrote: > > I'm in need of a seriously good Login/Registration > > application. > > Lots of 'em out there, for both PHP and Perl. Rather > than searching sourceforge and *scripts for "user > authentication" scripts, you might get further ahead by > finding a software package that authenticates the way you > like, then use that source code as inspiration when you > write your own. > > I use PHP for this sort of stuff. > > One method is to mimic .htaccess-style authentication as > described on the Zend page you've no doubt already looked > at. Another way is to use session variables. It's > pretty straightforward -- the user supplies a username > and password in a form, which is submitted to a script > which checks them against the database, and sets a > session variable that indicates to "secure" scripts that > this user is kosher. In my case, I set elements in an > array with session details for the user -- their > username, customer ID, language preference, display > theme, etc. Once the array is set, the login script > forwards the user to a "secure" page, which checks for > the existence of the session variables. If they're not > set, the "secure" page forwards the user back to the > login page. The code that does this is in a file > require()d by each "secure" script on the site. > > All in all, the login intelligence I'm using here > comprises less than 50 lines of PHP code. It was written > a few years ago, so I could probably tighten it up even > more if I felt the urge to rewrite. > > The moral here is that if you're developing software, > develop the software. If you look for example code for > every little thing you need to write, you'll never get > anything finished. If instead of searching script > archives for what you needed, you had just sat down and > written it yourself, you'd likely be hours ahead. The > search for a wheel that matches your precise > specifications may very well take longer than simply > reinventing it. > > > The core of this code should really be written so that > > users don't have to recreate it as needed...!!!! I'm > > looking for something "Open Source". > > I'm not sure what you mean by "recreate it as needed". > And of course, any example code you find will likely be > open source. Closed source things tend not to be > distributed, because they're, well, closed source. -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php