PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

392 Chapter 17 Implementing Authentication with PHP and MySQL
Each computer connected to the Internet has a unique IP address. From a visitor’s
IP address, you might be able to deduce a little about her.You can find out who owns
an IP and sometimes make a reasonable guess as to a visitor’s geographic location.
Some addresses are more useful than others. Generally, people with permanent Internet
connections have a permanent address. Customers dialing into an ISP usually get only
the temporary use of one of the ISP’s addresses.The next time you see that address, it
might be used by a different computer, and the next time you see that visitor, she will
likely be using a different IP address. IP addresses are not as useful for identifying people
as they might at first glance seem.
Fortunately for web users, none of the information that their browsers give out
identifies them. If you want to know a visitor’s name or other details, you will have to
ask her.
Many websites provide compelling reasons to get users to provide their details.The
New York Times newspaper (http://www.nytimes.com) provides its content free, but only
to people willing to provide details such as name, sex, and total household income. Nerd
news and discussion site Slashdot (http://www.slashdot.org) allows registered users to
participate in discussions under a nickname and customize the interface they see. Most
e-commerce sites record their customers’ details when they make their first order.This
means that a customer is not required to type her details every time.
Having asked for and received information from your visitor, you need a way to associate
the information with the same user the next time she visits. If you are willing to
make the assumption that only one person visits your site from a particular account on a
particular machine and that each visitor uses only one machine, you could store a cookie
on the user’s machine to identify the user.
This arrangement is certainly not true for all users. Many people share a computer,
and many people use more than one computer. At least some of the time, you need to
ask a visitor who she is again. In addition to asking who a user is, you also need to ask
her to provide some level of proof that she is who she claims to be.
As discussed in Chapter 15,“E-commerce Security Issues,” asking a user to prove her
identity is called authentication.The usual method of authentication used on websites is
asking visitors to provide a unique login name and a password. Authentication is usually
used to allow or disallow access to particular pages or resources, but can be optional, or
used for other purposes such as personalization.
Implementing Access Control
Simple access control is not difficult to implement.The code shown in Listing 17.1
delivers one of three possible outputs. If the file is loaded without parameters, it will display
an HTML form requesting a username and password.This type of form is shown in
Figure 17.1.