how to restrict access to admin pages

[vinpkl]

hi

i am working on admin section which has a login page with login id and pasword form.
in my admin section i have many pages say like manage_products.php, description.php, user.php etc.

if i have to access the manage_products.php page then i can access it just typing like the link below

http://localhost/vineet/admin/manage_products.php

without entering login user and pasword.

i want to restrict the access of this page through admin panel only. No one should able to access any of the page by typing the url directly. how is it possible.

vineet

[Markus]

hi

i am working on admin section which has a login page with login id and pasword form.
in my admin section i have many pages say like manage_products.php, description.php, user.php etc.

if i have to access the manage_products.php page then i can access it just typing like the link below

http://localhost/vineet/admin/manage_products.php

without entering login user and pasword.

i want to restrict the access of this page through admin panel only. No one should able to access any of the page by typing the url directly. how is it possible.

vineet

You need to write a login page which would compare the user give data against a database of admin credentials. If they matched, set a cookie or a session saying the user has permission to access restricted pages. On restricted pages check if a cookie/session is set to allow them access.

Google

[pedalpete]

another way to go is to use apache and an access file.
Depends on what you want to do. I think if the admin pages are just for you and a few others, the database login route may be overkill.

check out this link
http://www.yolinux.com/TUTORIALS/LinuxTutorialApacheAddingLoginSiteProtection.html

[zabsmarty]

for this you will be take a session ID or session varaible from admin so when you will login as admin then store admin id or any variable in session variable and on top of each page check that if this variable is empty then go for login .

for examle:

 
if(!isset($_SESSION['adminemail']))
{
header("location:login.php');
exit();
}
 
 

hope you will be unserstand.
Thanks

[Markus]

for this you will be take a session ID or session varaible from admin so when you will login as admin then store admin id or any variable in session variable and on top of each page check that if this variable is empty then go for login .

for examle:

 
if(!isset($_SESSION['adminemail']))
{
header("location:login.php');
exit();
}
 
 

hope you will be unserstand.
Thanks

Again, like I have already suggested.