How to require a password to update a page

hdshngout · 08-07-2005, 01:53

hi, i made a site like the neopets guilds where users can create guilds and create small sites similar to the neopets pet pages. what i want to know is how do you make it so the user has to put in their password before the user can update a guild or their profile. I have had major security issues and i really need this code. Any help would be appreciated.

FrozenDice · 08-07-2005, 06:40

Well we don't know how your page is built so its going to be hard to just supply you with a block of code.

You could just (assuming you use php) have them pass the password and username through the url. Although that is a little insecure. Or you could just use .htaccess to make a protected directory where the guild leader would change the settings there. I'm assuming its a seperate page where they fiddle arround with the settings. More secure.

Tell me which idea you like and I can give your more info on them.

hdshngout · 08-07-2005, 07:11

my page is built using php, i dont know which would be better. but what ever way i do it, there has to be a way that a form could insert the password and id either into the database or into a htaccess file.

FrozenDice · 08-07-2005, 20:04

Are you using mysql on this website? I'm assuming you are because that would be the easiest route. Either way just make a directory for every user, apply a .htaccess to it using their password (make php write the .htaccess file and change passwords) and have the script inside there which makes the changes you want to the guild that they select. Do you understand or am I totally being confusing?

Sameth · 09-07-2005, 05:59

oh, if you use the .htaccess route changing the htaccess is easy and to change the .htpasswd just use the unix command and append it to the file, also you can use groups in .htaccess. for ease of use i'd recomend php but for security go with .htaccess because its built into apache and quite more secure and not as vurnerable. but if you go with .htaccess all the passwords are encoded so you can't just see them so you can't do easy password retreval. I'd personaly go with php, thats because i've done it before.

I think you can put php and apache .htaccess password stuff together somehow.

08-07-2005, 01:53	#1 (permalink)
hdshngout Newbie Join Date: May 2005 Posts: 6 iTrader: 0 / 0%	How to require a password to update a page hi, i made a site like the neopets guilds where users can create guilds and create small sites similar to the neopets pet pages. what i want to know is how do you make it so the user has to put in their password before the user can update a guild or their profile. I have had major security issues and i really need this code. Any help would be appreciated.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Do You Require Resolution Time Guarantee?	kondorr	Hosting Forum	3	09-09-2008 07:59
Google ban and PR Update	Gosu	Google Forum	3	13-07-2006 17:28
Page Rank Update	rustypaulin	General Webmaster Discussion	2	20-10-2005 19:45
PR Update	kprhosting	Google Forum	11	19-07-2005 21:40
Next Google Update?	Wistow	Google Forum	4	10-03-2005 14:02

08-07-2005, 06:40	#2 (permalink)
FrozenDice Senior Member Join Date: Jun 2005 Posts: 389 iTrader: 0 / 0%	Well we don't know how your page is built so its going to be hard to just supply you with a block of code. You could just (assuming you use php) have them pass the password and username through the url. Although that is a little insecure. Or you could just use .htaccess to make a protected directory where the guild leader would change the settings there. I'm assuming its a seperate page where they fiddle arround with the settings. More secure. Tell me which idea you like and I can give your more info on them.

08-07-2005, 07:11	#3 (permalink)
hdshngout Newbie Join Date: May 2005 Posts: 6 iTrader: 0 / 0%	my page is built using php, i dont know which would be better. but what ever way i do it, there has to be a way that a form could insert the password and id either into the database or into a htaccess file.

08-07-2005, 20:04	#4 (permalink)
FrozenDice Senior Member Join Date: Jun 2005 Posts: 389 iTrader: 0 / 0%	Are you using mysql on this website? I'm assuming you are because that would be the easiest route. Either way just make a directory for every user, apply a .htaccess to it using their password (make php write the .htaccess file and change passwords) and have the script inside there which makes the changes you want to the guild that they select. Do you understand or am I totally being confusing?

09-07-2005, 05:59	#5 (permalink)
Sameth Cool Newbie Join Date: Jun 2005 Posts: 28 iTrader: 0 / 0%	oh, if you use the .htaccess route changing the htaccess is easy and to change the .htpasswd just use the unix command and append it to the file, also you can use groups in .htaccess. for ease of use i'd recomend php but for security go with .htaccess because its built into apache and quite more secure and not as vurnerable. but if you go with .htaccess all the passwords are encoded so you can't just see them so you can't do easy password retreval. I'd personaly go with php, thats because i've done it before. I think you can put php and apache .htaccess password stuff together somehow.

How to require a password to update a page

How to require a password to update a page

Similar Threads