Question

I’m looking for a php script so my entire site needs a password to access. I don’t want a sql database, I just want one user who’s credentials are set in a variable.

I have

config.php

<?php
$secured = false;
$username = "user";  // Set manually by editing config
$password = "pass";  //Set manually by editing config
?>

Then index.html

<form action="auth.php" method="post">
Username: <input type='text' name="user" value='' />
Password: <input type='password' name="password" value='' />
<input type='submit' value='Log in' />
</form>

Then auth.php (This is what I need coded)

<?php
require once "config.php"
If  $secured = false the redirect to page1.html 

// So if its false don’t require authentication at all anywhere on site.

If $secured = true then ask for username and password. 
If wrong display error message.
If right redirect to page1.html 
?>

That’s what I’m trying to achieve. I then also need the login stored as a session variable so it remembers you logged in and checks on each page that you are logged in. Then finally a way to log out. So a button I can just stick somewhere will do the job. Hope this all makes sense.

Question : How does the auth.php script look like?

Thanks

Answer 1

You could use sessions to remember if a user has logged in. To do that, add:

session_start();

in config.php

On every page that requires log in, add this at the top of the script:

require_once('config.php');
if ($secured && (!isset($_SESSION['loggedin']) || !$_SESSION['loggedin'])) {
    header('Location: index.html');
    exit;
}

Auth.php should look like the following.

<?php
require_once("config.php");
If (!$secured) {
    header('Location: page1.html');
    exit;
}
if (isset($_POST['user']) && isset($_POST['password'])) {
    if ($_POST['user']==$username && $_POST['password']==$password) {
        // OK
        $_SESSION['loggedin'] = true;
        header('Location: page1.html');
        exit;
    } else {
        echo "Bad login credentials. <a href=\"index.html\">Try again</a>";
    }
} else {
    // not logging in
    header('Location: index.html');
    exit;
}
?>

To sign out, just create a script logout.php:

<?php
require_once('config.php');
$_SESSION['loggedin'] = false;
?>