Secure your page with basic realm http header. Of coz, we use PHP based, not htpasswd and .htaccess file.

By : hermawan

<?php
/************************************************\
* Class Name : security() *
* Input : BASIC REALMS *
* Creator : Hermawan Haryanto *
* Email : hermawan@codewalkers.com *
* License : GPL (General Public License) *
\***********************************************/

// START FILE: security.php
session_start();
$errorlogin = "Authentication Required"; // Text to display when login error
$basicrealm = "Private Stuff"; // Displayed text on login form
$authentication = Array (1=>Array("user1", "pass1"), // User and Pass for User-1
2=>Array("user2", "pass2"), // User and Pass for User-2
3=>Array("user3", "pass3"));// User and Pass for User-3

class security {
var $authentication = Array();
var $errorlogin;
var $basicrealm;
function security() {
global $authentication, $errorlogin, $basicrealm;
$this->authentication = $authentication;
$this->errorlogin = $errorlogin;
$this->basicrealm = $basicrealm;
}
function secureMe() {
global $_SESSION, $PHP_AUTH_USER, $PHP_AUTH_PW;
if (trim($PHP_AUTH_USER)!=""&&trim($PHP_AUTH_PW)!="") {
if($this->checkLogin($PHP_AUTH_USER, $PHP_AUTH_PW)) return true;
}
if (!$_SESSION||$_SESSION["passed"]!="") {
$this->showLogin();
return false;
}
}
function showLogin() {
global $login_error, $realms;
header('WWW-Authenticate: Basic realm='.$this->basicrealm);
header('HTTP/1.0 401 Unauthorized');
print $this->errorlogin;
exit();
}
function checkLogin($username, $password) {
for($i=0;$i<count($this->authentication);$i++) {
if($username == $this->authentication[$i][0] &&
$password == $this->authentication[$i][1]) {
$j++;
}
}
if($j!=0) return true;
}
};
// END FILE: security.php
?>

Put the line below on the top of the page you wish to secured.

<?php
require_once("./security.php");
$security = new security;
if($security->secureMe()) $passed = "true"; session_register('passed');
?>

DISCLAIMER: The content provided in this article is not warranted or guaranteed by Developer Shed, Inc. The content provided is intended for entertainment and/or educational purposes in order to introduce to the reader key ideas, concepts, and/or product reviews. As such it is incumbent upon the reader to employ real-world tactics for security and implementation of best practices. We are not liable for any negative consequences that may result from implementing any information covered in our articles or tutorials. If this is a hardware review, it is not recommended to open and/or modify your hardware.

More User Management Code Articles
More By Codewalkers

blog comments powered by Disqus