Re: Security

>Hi >Any suggestions on how I lock access to certain pages, like the >ones where information gets added to the site from? >Using IIS 5 and PHP 4 on Windows 2000 (No A.D.S. yet). >Should I create a table in the DB with usernames and passwords >and use that - I have played with that already, but still I dunnow >how to stop them from typing the direct URL? I do not know how to >use session variables yet, and I have an idea that they would come >in handy. >I'm also battling to get the header(); function to work after >submitting a form. I think also a problem which might be solved >using session variables - if you have code which does this, please >may I see it. >Thanks >Warwick Chapman (1999) >Assistant IT Manager >Glenwood High School, Durban, South Africa >031 2055241 >083 7797094 >www.glenwoodhighschool.co.za Hi Warwick... If you'd like to protect your php pages, you could do two things: 1: Search on the net for scripts. I'd recommend the zend site (www.zend.com), PHP ResourceIndex (php.resourceindex.com) and SourceForge. 2: write your own. Now, if you'd like to write your own, write a function that checks for a session, and if found, quits silently. The best way to do this, is to use authlevels, like so: function checkAuth($level=0) { GLOBAL $authSessionCookie; if ($level = 0) { return; } else { if ($authSessionCookie == '') { // user hasn't authenticated him/herself header("Location: yourloginpage.php"); exit; } // put your code here that get's the authLevel from the database // where the authSession equals the $authSessionCookie. you can // strongen the security with other stuff, like browser used, current // ip address (don't forget proxies), or whatever you want inhere and // makes sense to you. Be shure to add variables that you use to the // GLOBAL statement above... if ($authLevel >= $level) { return; } else { echo "<html>you are not authorized to view this page</html>"; exit; } } It's probably best to place this function in a common library that is used by all your pages, and then call this function first in each page, like this: <?php require("/path/to/common.php"); checkAuth(0); // rest of page ?> Now you can let people view all pages, without having to worry that those who aren't allowed to view a certain page can. Just use checkAuth(0) for all pages wich don't require authentication, and use higher numbers to limit the use of the page. Now you can set authLevels for each group, like so: - Visitors : authLevel = 0 - First Year Students : authLevel = 1 - Other Students : authLevel = 2 - Teachers : authLevel = 3 - Webmasters : authLevel = 4 or whatever's appropriate. You can even extend the function to allow all people with the same authLevel or lower, or only allow people where authLevel equals the authLevel requested, and deny all others... (Like a section for Teachers wich even Webmasters can't view) Hope this helped a bit... Regards, Sjon. ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1