RSS

Administrator's Page Security Settings With PHP

Please support our PHP advertiser: Lunarpages PHP Web Hosting

Views: 613 | Replies: 3 | Thread Tools Display Modes

•

Join Date: Oct 2007

Location: Penang Island, Malaysia

Posts: 176

Reputation: lordx78 is an unknown quantity at this point

Rep Power: 2

Solved Threads: 2

lordx78

Offline

Junior Poster

Administrator's Page Security Settings With PHP

Feb 9th, 2008

I have 2 some pages in the website I'm developing. I've also an admin page. If i want to log in to the admin page, I've to key in username and password and it will be validated and redirect me to the admin's page. The problem is, if I manually input the direct url for the admin's page, the browser will open the url without asking for any validation.

?? Question ??

1. How to disable the user to just open the admin's page with direct link without any validation?

2. How to prompt the user to key in username and password if the direct url is used?

3. How to disable the usage of direct url (for admin's page)?

"I might not be the BEST but I'm not like the REST!"

•

Join Date: Feb 2008

Posts: 12

Reputation: web_lock is an unknown quantity at this point

Rep Power: 1

Solved Threads: 1

web_lock

Offline

Newbie Poster

Re: Administrator's Page Security Settings With PHP

Feb 9th, 2008

•

Originally Posted by lordx78

I have 2 some pages in the website I'm developing. I've also an admin page. If i want to log in to the admin page, I've to key in username and password and it will be validated and redirect me to the admin's page. The problem is, if I manually input the direct url for the admin's page, the browser will open the url without asking for any validation.

?? Question ??

1. How to disable the user to just open the admin's page with direct link without any validation?

2. How to prompt the user to key in username and password if the direct url is used?

3. How to disable the usage of direct url (for admin's page)?

I've handled this problem in my applications by using a SESSION random value which is initiated at my login page itself.
Lets say your initial loading page is login.php. It would contain the following LOC

Help with Code Tags

(Toggle Plain Text)

<?php
session_start();
if($_POST[úserID'])
{
$_SESSION['randomvalue']=rand();
$_SESSION['loginValue']=md5($_SESSION['randomValue']);
}
else
{
écho '<script>';
echo "document.location='logout.php'";
echo"</script>";

}
?>

Please note , this page is accessible only through login .

Lets say the URL to the adminSetting is admin.php. include these lines in the code

Help with Code Tags

(Toggle Plain Text)

if($_SESSION['loginValue'])
{
$checkValue=md5($_SESSION['randomValue']);
if($checkValue==trim($_SESSION['loginValue']){
{
}
else
{
écho '<script>';
echo "alert('Enter USER NAME and PASSWORD')";
echo"</script>";
}
}

The direct usage of url can be controlled through javascript.
Hope this helped.

web_lock
--------------------------------------------------------------------------------------
God created the world out of atoms, I intend on creating mine out of 1's and 0's

•

Join Date: Oct 2007

Location: Penang Island, Malaysia

Posts: 176

Reputation: lordx78 is an unknown quantity at this point

Rep Power: 2

Solved Threads: 2

lordx78

Offline

Junior Poster

Re: Administrator's Page Security Settings With PHP

Feb 10th, 2008

Thanks for the code, I will give it a try before I reply this thread.

"I might not be the BEST but I'm not like the REST!"

•

Join Date: Nov 2007

Location: Las Vegas, Nevada

Posts: 83

Reputation: johnsquibb is an unknown quantity at this point

Rep Power: 2

Solved Threads: 14

johnsquibb johnsquibb is offline

Offline

Junior Poster in Training

Re: Administrator's Page Security Settings With PHP

Feb 10th, 2008

•

Originally Posted by web_lock

I've handled this problem in my applications by using a SESSION random value which is initiated at my login page itself.
Lets say your initial loading page is login.php. It would contain the following LOC
Help with Code Tags

(Toggle Plain Text)
<?php
session_start();
if($_POST[úserID'])
{
$_SESSION['randomvalue']=rand();
$_SESSION['loginValue']=md5($_SESSION['randomValue']);
}
else
{
écho '<script>';
echo "document.location='logout.php'";
echo"</script>";

}
?>
<?php session_start(); if($_POST[úserID']) { $_SESSION['randomvalue']=rand(); $_SESSION['loginValue']=md5($_SESSION['randomValue']); } else { écho '<script>'; echo "document.location='logout.php'"; echo"</script>"; } ?>

That works. I would change one thing, however.

instead of echoing the javascript to redirect the page, I would keep it as PHP by using the header function like so:

 Help with Code Tags 
 php Syntax (Toggle Plain Text) 
<?php
session_start();
if($_POST['userID'])
{
$_SESSION['randomvalue']=rand();
$_SESSION['loginValue']=md5($_SESSION['randomValue']);
}
else
{
//redirect to login
header('Location: login.php');
exit();
 
}
?>
<?php
session_start();
if($_POST['userID'])
{
$_SESSION['randomvalue']=rand();
$_SESSION['loginValue']=md5($_SESSION['randomValue']);
}
else
{
//redirect to login
header('Location: login.php');
exit();

}
?>

using javascript to redirect will allow the user access to the page you're trying to keep secure simply by disabling javascript in their browser. The header function redirects server-side, so they never get to the page.

For additional security, you should probably also validate the $_POST['userID'] against a username/password combination in a database, otherwise someone could write a script on a remote website to post any value for 'userID' and it will let them through.