RE: [PHP] RE:tutorials for login system...

Andy B <mailto:aborka1@wmis.net> on Wednesday, March 24, 2004 3:27 PM said: > questions...hmmm... cant think of any questions at the minute but i > do have some physical standards of a login system that im looking for: alright let's see... > 1. as normal it needs to carry the session from private section to > public section and back again if user is already logged in done automatically if the site uses the same domain (iirc). in other words, going from http to https (i assume this is what you mean by public and private) does not present any problems under normal circumstances. > 2. it needs various access levels i.e. system admin/full > access/module admin and so on after the user authenticates store the users access level in a session variable. at each point where the users access level comes into play perform a test on this value. <?php $_SESSION['al'] = AL_PLUS_USER; ?> i suggest you use constants to define your access levels. <?php // "AL" stands for Access Level define("AL_USER", 1); define("AL_PLUS_USER", 2); define("AL_ADMIN", 3); ... ?> then you can do the following in your "secure" pages: <?php include "al_constants.php"; if($_SESSION['al'] >= AL_PLUS_USER) { // let them in } else { // keep them out } ?> > 3. it needs to be "modular" in the sense that it needs to be able to > accept "modules" to it i.e. a guestbook admin section/news admin > section/events admin section and so on hmm.. as long as you use the same scheme/naming convention throughout each module you should be fine. > 4. "system admins" (basic system admins) have the lowest login access > possible i.e. they have admin access to the admin sections of the > modules and say site admin/owners have access to user database/change > user id's/pwd/add user/delete user and stuff this is up to you and will be defined with the al_constants.php file. you can of course call it whatever you want. > 5. all users have a way to change their password or user info... in this case don't put a restriction on the password changing page/function. > if you want i can setup a spec outline for it and post it... feel free. hth, chris.