Ad:

PHP Discussion Thread
Unsolved
Views: 2798

Jan 18th, 2005

PHP Query, Make users login before accessing a movie?

Expand Post »

i'm making a website for a friend with his movies in, he wants users to login before being able to view these movies, i don't know how to stop them viewing it by typing in the address.

Thanks, expect many more help requests as i am a noob

- Alee

Similar Threads

Warning: session_start(): Cannot send session cache limiter - headers already sent in PHP
PHP & Apache Server Security Questions in PHP
Users have to login and logout twice, why? in PHP
erro on login code in PHP
PHP query CSV in PHP

alee

Reputation Points: 10

Solved Threads: 0

Newbie Poster

Offline

2 posts
since Jan 2005

Permalink

Jan 18th, 2005

Re: PHP Query, Make users login before accessing a movie?

PLEASE BE CAREFUL!!!!!
if you start usign variables in the following script other users can do very malicious things with it! Including download your PHP source code!!!! which (if you use a db) would contain your database passwords!!!!

you must also set the appropiate MIME type if you are not usign the type i specified. and replace the whole login thing with your own validation scheme, this should be all u need.

PHP Syntax (Toggle Plain Text)
<?php
 
if (!$logged_in)
{
	echo "so sorry you must log in!";
	exit();
}
 
 
//the following 3 lines means they must always download a fresh copy (just to verify they are logged in!)
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
header("Cache-Control: no-store, no-cache, must-revalidate");
header("Pragma: no-cache");
 
 
header("Content-type: video/mpeg"); //works for .mpe .mpeg .mpg
 
 
//to force the end user to download the file, uncomment the following line, otherwise it will stream from your site (aka lots of bandwidth)
//header("Content-Disposition: attachment; filename=video.mpg");
 
//replace this next line with the appropiate file name
readfile('my-super-secret-private-video.mpg');
 
?>
<?php

if (!$logged_in)
{
	echo "so sorry you must log in!";
	exit();
}


//the following 3 lines means they must always download a fresh copy (just to verify they are logged in!)
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
header("Cache-Control: no-store, no-cache, must-revalidate");
header("Pragma: no-cache");


header("Content-type: video/mpeg"); //works for .mpe .mpeg .mpg


//to force the end user to download the file, uncomment the following line, otherwise it will stream from your site (aka lots of bandwidth)
//header("Content-Disposition: attachment; filename=video.mpg");

//replace this next line with the appropiate file name
readfile('my-super-secret-private-video.mpg');

?>

paradox814

Reputation Points: 13

Solved Threads: 4

Posting Whiz

Offline

351 posts
since Oct 2004

Permalink

Jan 20th, 2005

Re: PHP Query, Make users login before accessing a movie?

so its ok if i just use that code without editing it?

I will have to edit it to work with my php a little. like the user logged condition thingy.

But thanks VERY much, but surely. can't they still point their browser to the actual file?

alee

Reputation Points: 10

Solved Threads: 0

Newbie Poster

Offline

2 posts
since Jan 2005

Permalink

Jan 20th, 2005

Re: PHP Query, Make users login before accessing a movie?

Quote originally posted by alee ...

so its ok if i just use that code without editing it?

no you will need to change the file name to whatever your actual file name is myvideo1.mpg then that would replace my-super-secret-private-video.mpg

Quote originally posted by alee ...

But thanks VERY much, but surely. can't they still point their browser to the actual file?

they can but that assumes they know the real file name, as the file they will be sent will be automatically renamed to video.mpg. The other thing is yes that was a very astute observation they can still point their browser to the real file name (assuming they know the real file name, or you have your .htaccess file to allow indexing), so to avoid this possibility you should place your video file in the parent directory of your public_html folder, so if you did this you could call the file by saying: /private/my-super-secret-private-video.mpg instead of just usign my-super-secret-private-video.mpg (make the path absolute so it doesn't matter what folder the php file is in.

Advanced note: when usign relatives path your "/" directory is NOT always the same in php as it is in FTP / SSH (check with your webhost to find out what is your home directory or look in the phpinfo() command)

paradox814

Reputation Points: 13

Solved Threads: 4

Posting Whiz

Offline

351 posts
since Oct 2004

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.

Previous Thread in PHP Forum Timeline: New to php and getting frustrated

Next Thread in PHP Forum Timeline: Need Help with Side Nav Include

DaniWeb Message

Cancel Changes

User Name
Password