How can I protect a directory using PHP?

Question

Notice, this is a remote server, I don't have access to it, only to the FTP. I want to do this using purely PHP, not .htaccess. Is there a way similar to .net, where you put the web.config file and you set who can access it and their password?

Answer 1

Why using PHP? .htaccess files were designed for this purpose. If you're trying to do something like store user logons in a database, look at the something like Mod_auth_mysql

What you can do is place the files outside of your webroot and write a php script to serve those files after passing your authentication logic.

Answer 2

As far as I'm aware there is no way to do this purely in PHP.

If you can use .htaccess but cannot upload it for whatever reason, then I would suggest writing the htaccess via PHP.

Answer 3

Directory protection is always the work of the webserver. Whatever you do in your PHP script, it's the webserver's responsibility to execute the script in the first place. If you try to access another file in the directory, the webserver will hand it to the user without even looking at your script. If the user requests a directory listing, it's the webserver that's handing it to the user.

You will have to configure the webserver correctly, most likely using .htaccess files, if you want to protect real, "physical" directories.

Answer 4

I'd say the equivalent of that kind of functionnality from web.config on Apache is with .htaccess files : PHP is used to generate pages, but if you are trying to work at the directory level, the check has to come before PHP is even called.

In your PHP scripts, you can access the data of HTTP Authentication ; see $_SERVER, especially PHP_AUTH_USER and PHP_AUTH_PW ; but the protection will be at the file's level, and not directory -- and, obviously, it will be enforced only for PHP files (not images in a subdirectory, for instance).

For more informations, you can have a look at, for instance : HTTP Basic and Digest authentication with PHP

The right way to do this for an entire directory is definitly with .htpasswd / .htaccess files (or directly in the Apache's configuration file).