MySQL/PHP/htaccess auth system

At 05:48 PM 7/12/2000, Richard Lynch wrote:

You can have PHP send the headers that .htaccess would be sending. See the manual http://php.net You could also look into mod_auth_mysql, which marries Apache and MySQL to do authentication -- no PHP involved at all.

I have recently written a system which does the following. Im not sure if this is sound security wise, or even coding wise, but it works a treat for me..... Plus it controls the site as to what pages different users can access based on a level number system I use htaccess to simply auth users into the site (I like doing it this way because it protects the entire directory). And the index PHP page does 2 things. Queries the database which lists all known usernames, and their level of access. Then it takes those 2 figures and sets them as cookies. At this stage its authenticated the user, and set their username and access level for use later. Then I simply have a line in each PHP file I write like

        auth_user($accesslevel,10);
This calls the auth_user function (below) and tells it what level the user has been set (from the cookie) and what level is required for the user to access the page.

The function simply compares the level of access set to the user to the level of access required for that page, and if its okay (the user has higher or equal access) then it continues, otherwise it reports an error page. So basically, it allows the site to be controlled by levels of access. So you can set a users level, based on what you want them to be able to do. It can be as simple as a 2 tier system (those who can update data, and those who can only view it) or structured on a multi level system. Like I said, I dont know if a system like this is any good structurally, but comments on its concept would be appreciated. I can put the code in if you want, but I wanted to keep it simple to start with. --

      Chris Aitken - Webmaster/Database Designer - IDEAL Internet

email: chris@ideal.net.au phone: +61 2 4628 8888 fax: +61 2 4628 8890

            --------------------------------------------

      Unix -- because a computer's a terrible thing to waste!