PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

Using Basic Authentication
399
Looking back at Listing 17.3, you can see that we created one user (‘username’)
with an unencrypted password and another user with an encrypted one (‘testuser’) to
illustrate the two possible approaches.
Protecting Multiple Pages
Making a script like the ones in Listings 17.1 and 17.2 protect more than one page is a
little harder. Because HTTP is stateless, there is no automatic link or association between
subsequent requests from the same person.This makes it harder to have data, such as
authentication information that a user has entered, carry across from page to page.
The easiest way to protect multiple pages is to use the access control mechanisms
provided by your web server.We look at these mechanisms shortly.
To create this functionality yourself, you could include parts of the script shown in
Listing 17.1 in every page that you want to protect. Using auto_prepend_file and
auto_append_file, you can automatically prepend and append the code required to
every file in particular directories.The use of these directives was discussed in Chapter 5,
“Reusing Code and Writing Functions.”
If you use this approach, what happens when your visitors go to multiple pages within
your site? Requiring them to re-enter their names and passwords for every page they
want to view would not be acceptable.
You could append the details the users entered to every hyperlink on the page.
Because they might have spaces or other characters that are not allowed in URLs, you
should use the function urlencode() to safely encode these characters.
This approach still has a few problems, though. Because the data would be included
in web pages sent to the users and the URLs they visit, the protected pages they visit
will be visible to anybody who uses the same computer and steps back through cached
pages or looks at the browser’s history list. Because you are sending the password back
and forth to the browser with every page requested or delivered, this sensitive information
is being transmitted more often than necessary.
There are two good ways to tackle these problems: HTTP basic authentication and
sessions. Basic authentication overcomes the caching problem, but the browser still sends
the password to the server with every request. Session control overcomes both of these
problems.We look at HTTP basic authentication now and examine session control in
Chapter 23,“Using Session Control in PHP,” and in more detail in Chapter 27,
“Building User Authentication and Personalization.”
Using Basic Authentication
Fortunately, authenticating users is a common task, so authentication facilities are built
into HTTP. Scripts or web servers can request authentication from a web browser.The
web browser is then responsible for displaying a dialog box or similar device to obtain
required information from the user.