Re: authentication for lack of a better subject

Wow. I'm not quite at that level, but was thinking that... on my site the usernames are unique throughout all user types (buyers, sellers, production, etc) i could query the db based on the usertype (sellers should only be able to see seller pages). If that is not valid neither is the session anylonger, and if the usertype is correct (seller trying to modify a seller type url) the username is coming from the session, and that variable would be tough for a user to muck with? so they'd just see what ever is pertainent to then as a valid user. I think it sounds pretty good. David VanHorn wrote: > > > >I'm running apache, php4 and have sessions enabled through the site, > >mysql, etc. Can you do some type of authentication combining these > >programs? How do you guys skin this cat? > > Well, have a try at getting the data from: > http://www.spamwhack.com/Members/Mod_Account2.php > > Then, try it as an authenticated user with username abc and password def > from the page > http://www.spamwhack.com/Login.php > > You'll not have any luck, but have a try anyway. > The username and password are valid. > > Here's the thing: > The login page passes username and password to login2.php > > Login2 stores a 10 digit random cookie on your browser, and looks up the > account with the username, and picks up the encrypted password, and IP > address min and max restrictions. If your IP is ok, then it will encrypt > your password and compare with the stored. If they match, it stores the > cookie value in the database. > > Thereafter, every secure page you go to hands you a new random cookie, > takes your old cookie, looks it up, checks the IP, and if valid, stores the > new cookie for the next page. > > -- > www.SpamWhack.com A pre-emptive strike against spam > Where's dave? > http://www.findu.com/cgi-bin/find.cgi?kc6ete-9 > > My transistor sings > with unintended parasitic > the smoke escapes > > By Jeff Stout