Password Protected Admin

[Ben Allen]

Hi,
I want to create a password protected page to administer my site from
(the news is read from a mySQL database and I have created a PHP form to
as a GUI to do this). I thought of password-protecting it by creating a
page with the login details (which are the same as those needed for the
mySQL database, passing these as variable to the admin page using POST
and then making changes to the database using these login variables. Is
this secure and/or practical? Will it alert the user to an incorrect
mySQL login straight away or wait until the submit button is pressed
(and changes are attempted to be made)?

The other option is using a password script such as this one
http://www.webdevtips.com/webdevtips...re/index.shtml

Any thoughts or other (relatively simple) ways of doing this?

Cheers,
Ben

[juglesh]

Ben Allen wrote:

Hi,
I want to create a password protected page to administer my site from
(the news is read from a mySQL database and I have created a PHP form to
as a GUI to do this). I thought of password-protecting it by creating a
page with the login details (which are the same as those needed for the
mySQL database, passing these as variable to the admin page using POST

dont do that. dont send your mysql passwords via post or over th web
in the clear.

check this:
http://groups-beta.google.com/group/...16ca332d1fbb48

please read to the bottom of the thread about using $_POST.

--
juglesh

[SOR]

<comp.lang.php , juglesh , ju*********@hotmail.com>
<11**********************@g49g2000cwa.googlegroups .com>
<25 Jul 2005 19:38:24 -0700>

dont send your mysql passwords via post or over th web
in the clear.

check this:
http://groups-beta.google.com/group/...16ca332d1fbb48

please read to the bottom of the thread about using $_POST.

Silly question time .

Even if the password is in the clear on a url - wont it only be the
admin or the webmaster who sees it *only* after they have logged in with
the correct password .

[Geoff Berrow]

I noticed that Message-ID:
<MP************************@no-cancel.newsreader.com> from SOR contained
the following:

Even if the password is in the clear on a url - wont it only be the
admin or the webmaster who sees it *only* after they have logged in with
the correct password .

...and anyone stranding behind him, or anyone checking the history or...
--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Colin McKinnon]

Ben Allen wrote:

The other option is using a password script such as this one
http://www.webdevtips.com/webdevtips...re/index.shtml

Any thoughts or other (relatively simple) ways of doing this?

This script is far from secure.

The quickest route would be to use the webserver's built-in security
mechanism. Basic authentication still sends the password in the clear but
leaving aside the huge vulnerability of it being sniffable it is reasonably
robust. Digest based authentication addresses the sniffing problem and is
supported on most modern software.

HTH

C.

[Samuel]

You might also try to google any md5 tutorial. It's "relatively simple"
to make a pretty secure authentication system with encrypted passwords.
http://es.php.net/md5

[luke]

My recommendation would be for you to do it through a .htaccess file. Most
web hosts will give you the ability to do this through your admin, but you
can do it by hand easily - do a google on it.

The problem with .htaccess files though, is, you get a naff looking box pop
up asking for your username and password. If you want to be able to design
the form you fill out, then a POST form will do the trick. This is how I've
written (what I hope are) secure admins.

At the very top of every page put: session_start(); - look at php.net for
documentation on PHP sessions if you're unsure what they are.

Have PHP create a new session variable when the password and username are
correct. e.g.:

if ($_POST['pass'] == "s2132t163" && $_POST['user'] == "me") {
$_SESSION['adminlogin'] = "yes";
}

On each page that needs to be protected, put this line before any content is
printed:

if (!isset($_SESSION['adminlogin'])) { die "Unauthorised access"; }

Having this means if the session variable hasn't been created, the page
won't load past this point and an 'unauthorised' message will display.

Ka kite,
Luke


"Ben Allen" <"ben.allen"@\"your.tonsils\"btinternet.com> wrote in message
news:dc**********@nwrdmz03.dmz.ncs.ea.ibs-infra.bt.com...

Hi,
I want to create a password protected page to administer my site from
(the news is read from a mySQL database and I have created a PHP form to
as a GUI to do this). I thought of password-protecting it by creating a
page with the login details (which are the same as those needed for the
mySQL database, passing these as variable to the admin page using POST
and then making changes to the database using these login variables. Is
this secure and/or practical? Will it alert the user to an incorrect
mySQL login straight away or wait until the submit button is pressed
(and changes are attempted to be made)?

The other option is using a password script such as this one
http://www.webdevtips.com/webdevtips...re/index.shtml

Any thoughts or other (relatively simple) ways of doing this?

Cheers,
Ben

[Geoff Berrow]

I noticed that Message-ID:
<11**********************@g44g2000cwa.googlegroups .com> from Samuel
contained the following:

You might also try to google any md5 tutorial. It's "relatively simple"
to make a pretty secure authentication system with encrypted passwords.

Don't you need to use a bit of Javascript to get round the browser
sniffing problem?

--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[SOR]

<comp.lang.php , Geoff Berrow , bl******@ckdog.co.uk>
<05********************************@4ax.com>
<Tue, 26 Jul 2005 08:05:42 +0100>

Even if the password is in the clear on a url - wont it only be the
admin or the webmaster who sees it *only* after they have logged in with
the correct password .

..and anyone stranding behind him, or anyone checking the history or...

Its what i've used on that guestbook script i'm writing .

See your point but can live it with as its only a guestbook that will
only be used by home users .

[Ben Allen]

Iluke wrote:

My recommendation would be for you to do it through a .htaccess file. Most
web hosts will give you the ability to do this through your admin, but you
can do it by hand easily - do a google on it.

The problem with .htaccess files though, is, you get a naff looking box pop
up asking for your username and password. If you want to be able to design
the form you fill out, then a POST form will do the trick. This is how I've
written (what I hope are) secure admins.

At the very top of every page put: session_start(); - look at php.net for
documentation on PHP sessions if you're unsure what they are.

Have PHP create a new session variable when the password and username are
correct. e.g.:

if ($_POST['pass'] == "s2132t163" && $_POST['user'] == "me") {
$_SESSION['adminlogin'] = "yes";
}

On each page that needs to be protected, put this line before any content is
printed:

if (!isset($_SESSION['adminlogin'])) { die "Unauthorised access"; }

Having this means if the session variable hasn't been created, the page
won't load past this point and an 'unauthorised' message will display.

Ka kite,
Luke

Thanks for your replies everyone. My host can do .htaccess which I
completely forgot about, although I don't like the pop-up boxes either.
Anyone know of any security issues doing it Luke's way? I may do it this
way, or use .htaccess.

Thanks,
Ben