Re: newbie user authentication question

To prevent the human (mine) error of forgetting to auth-check any page in areas like this I tend to keep them in their own subdirectorey and use .htaccess to autoprepend the auth-check code to all files in that subdir. Also enables me to allow web-based admin by my clients of those pages without them having to take care of the PHP code. HTH, TomH rachel@mediajumpstart.org ("Rachel Daniell") wrote in <NDBBIAMDMKMGBFAKLADNOEHCCBAA.rachel@mediajumpstart.org>: >Does anyone have advice for me on user authentication? > >To gain access to an area of a web site for certain member organizations only, I have >created a script that authenticates user names and passwords against a database that >using this type of code: > if (!isset($PHP_AUTH_USER)) { > header('WWW-Authenticate: Basic realm="Private"'); > header('HTTP/1.0 401 Unauthorized'); > exit; > } else if (isset($PHP_AUTH_USER)) { > > // check the user database for matching name & password....(etc.) > >The authentication against the database is working fine. >My only concern is, how do I make this work on multiple pages? All of the tutorials >I've found so far only address a single point of authentication, but I have several >pages in the private area of the site that a user could theoretically bookmark and >return to without being prompted to log in. >Should I copy this code onto each page? >Or is there some simple IF ELSE statement I can make on each page to check if they >have logged in already? >Or do I need to be doing this a different way altogether (such as with sessions)....? > >If anyone has any advice for me, I'd love to hear it. >cheers, >Rach > >------------------------------------------- >Rachel Daniell >Media Jumpstart >a nonprofit technology resource for NYC nonprofits >rachel@mediajumpstart.org >212-894-3386 > >