ansaurus

Question

What is the best way to password protect folder/page using php without a db or username

Answer 1

+5 A:

Assuming you're on Apache:

http://httpd.apache.org/docs/1.3/howto/htaccess.html#auth

Rob Stevenson-Leggett 2008-11-13 13:50:07

I would like to do this with php. Yes I know how to do it with .htaccess

Salt Packets 2008-11-13 13:52:10

Answer 2

A:

Well since you know it's insecure to begin with, you could store a password in a text file somewhere on your web server. When someone accesses the page you could show a form that asks for a password. If the password matches what is in the text file, then you reload the page and display the information. Using the text file will allow you to change the password without having to modify the page they are accessing when you want to change it. You're still going to be sending plaintext everywhere unless you're using SSL. Let me know if you need some code.

rodey 2008-11-13 14:03:28

Answer 3

+1 A:

I doubt if this would count as the best wasy of doing it, but it would work. And since security doesn't seem to be a big issue for you, the fact that this way's as insecure as hell probably won't bother you either.

Have a login.php page that takes a password and then sets a cookie if the login details are correct. Each php file can then check for the existence of the cookie to determine whether or not the user is "logged in" or not, and display information accordingly.

login.php
...
if(isset($_POST['password']) && $_POST['password'] == 'my_top_secret_word') {
    setcookie('loggedin', 'true', time() + 1200, '/url/');
} else {
    setcookie('loggedin', 'false', time() - 1200, '/url/');
    // display a login form here
}
etc

each "protected" page would then check for this cookie:

if(isset($_COOKIE['loggedin'])) {
    if($_COOKIE['loggedin'] == 'true') {
        $showHidden = true;
    } else {
        $showHidden = false;
    }
} else {
    $showHidden = false;
}

I'm sure you get the (highly insecure) idea ...

David Heggie 2008-11-13 14:10:34

Answer 4

+7 A:

You could quickly throw together a script like this, e.g. access.php.

<?php
//put sha1() encrypted password here - example is 'hello'
$password = 'aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d';

session_start();
if (!isset($_SESSION['loggedIn'])) {
    $_SESSION['loggedIn'] = false;
}

if (isset($_POST['password'])) {
    if (sha1($_POST['password']) == $password) {
        $_SESSION['loggedIn'] = true;
    } else {
        die ('Incorrect password');
    }
} 

if (!$_SESSION['loggedIn']): ?>

<html><head><title>Login</title></head>
  <body>
    <p>You need to login</p>
    <form method="post">
      Password: <input type="password" name="password"> <br />
      <input type="submit" name="submit" value="Login">
    </form>
  </body>
</html>

<?php
exit();
endif;
?>

Then on each file you want to protect, put at the top:

<?php
require('access.php');
?>
secret text

It isn't a very nice solution, but it might do what you want

Edit

You could add a logout.php page like:

<?php
    session_start();
    $_SESSION['loggedIn'] = false;
?>
You have logged out

Tom Haigh 2008-11-13 14:13:16

+1 For using a hashing algorithm to precalcuate and store. Though, SHA2 or at least SHA1 would be more secure.

Abyss Knight 2008-11-13 14:20:35

I don't know how much security the OP cares about.

rodey 2008-11-13 15:05:18

Answer 5

A:

I am doing approximately what David Heggie suggested, except without cookies. It does seem insecure as hell, but it is probably better having a bad password protection then none at all.

This is for internal site where people would have hell of a time remembering their login and password and would never go through sign up process... unless it is really easy they would not use the system at all.

I wanted to see other solutions to this problem.

With user base consisting of not very tech savvy people what are other ways to do this.

Salt Packets 2008-11-13 14:17:50

If it is for an intranet application you could use Windows Authentication or another single sign on system. At least, that's what we do here. Of course, our userbase is enormous so YMMV.

Abyss Knight 2008-11-13 14:22:26

It is not on a windows system and people will access it through internet. It is all sorts of bad.

Salt Packets 2008-11-13 14:40:49

Looks like tomhaigh has exactly what you're looking for.

rodey 2008-11-13 15:08:05

Answer 6

+1 A:

If you want to avoid cookies, sessions and don't want to play with .htaccess files, you can also do http authentication soley with PHP:

http://www.php.net/manual/en/features.http-auth.php

You can hard code the password into the file and change it as needed, or include it from a file not in your web_accessible directory.

The downside is you don't have the ability to format the "login" screen - it will be a standard http authentication dialog box

Laura Williams 2008-11-14 16:36:19

Answer 7

A:

Well since you know it's insecure to begin with, you could store a password in a text file somewhere on your web server. When someone accesses the page you could show a form that asks for a password. If the password matches what is in the text file, then you reload the page and display the information. Using the text file will allow you to change the password without having to modify the page they are accessing when you want to change it. You're still going to be sending plaintext everywhere unless you're using SSL. Let me know if you need some code.

THAT'S INSANE! The most unsecure idea ever.

tomasbarao 2010-03-08 23:31:43

ansaurus

tags:

views:

answers:

What is the best way to password protect folder/page using php without a db or username

related questions