Member Avatar for tez

I have written a web-site using CuteSite Builder and would now like to have a page for members only. The programme offers page password protection with php and/or asp. I have tried to load these via the HTML insertion feature but nothing seems to work. Any advice welcomed. (Windows XP/3) Ta, Tez

  • 2 Contributors
  • 1 Reply
  • 192 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by benivere

Dani AI

Generated

Quick diagnosis for : CuteSite Builder typically outputs static HTML. Server-side PHP/Classic-ASP placed into an exported page will be written into the file as plain text unless that file is saved with a server-processed extension (.php or .asp) and served by a host that runs the appropriate interpreter. Opening the page locally with a file:// URL also will not execute server-side code.

Two quick checks to isolate the issue. Create a PHP test file named test.php containing:

<?php
phpinfo();
?>

and a Classic ASP test file named test.asp containing:

<% Response.Write "ASP running" %>

Upload each to the hosting root and fetch them via http:// (not file://). If the source is shown instead of processed output, the host is not handling that engine or the file extension changed during upload.

Short-term protection options. If the host supports Apache, a simple Basic Auth via .htaccess works without writing application code:

AuthType Basic
AuthName "Members only"
AuthUserFile /full/server/path/.htpasswd
Require valid-user

IIS does not use .htaccess — enable authentication via IIS Manager or the host control panel, or use a small server-side login page if the host supports ASP/PHP.

Security notes and long-term advice. Do not rely on client-side tricks. Always serve login pages over HTTPS, store password hashes (bcrypt/Argon2) rather than plain text, set session cookies with HttpOnly and Secure flags, and enforce timeouts. For a robust membership system, ’s recommendation to keep authentication checks in the application layer and validate access centrally is the correct long-term approach.

Member Avatar for benivere

One simple way is to use database tables for users and user authentication. User authentication is a token created by your stored procedures / PHP code.

You can either store the authentication within the HTML page (required if the user has disabled cookies, in which case consider HTTPS), or the PHP global session array. As the user requests a web page, the code attempts to retrieve the user authentication token, which is the key to unlocking the restricted content. You can also enhance your security by making the user token a parameter to your stored procedures so your backend code can help enforce authorization and timeouts.

In your stored procedures, make sure all access to restricted content is prefaced by a call to a ValidateAuthentication stored procedure, which both validates the token and "touches" the timer so a timeout value can be set and enforced (mostly a security issue, ensuring someone doesn't accidentally leave a browser open for lengthy periods, and for helping avoid hacking attempts that might lag).

Note the encouragement to use stored procedures. This provides extra protection from code injection and makes sure that all client applications follow the same rules for content access.

It takes a few steps, but proves useful for implementing application based security.

There are other methods, of course. This method places the burden, and the flexibility of managing access to restricted content withing the control of your application (using database parameters in the above case).

Hope this helps.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.