PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

408 Chapter 17 Implementing Authentication with PHP and MySQL
We included the directive Auth_MySQL_Encryption_Types to specify that we want to
use MySQL password encryption. Acceptable values are Plaintext, Crypt_DES,or
MySQL. Crypt_DES is the default and uses standard Unix DES-encrypted passwords.
From the user perspective, this mod_auth_mysql example will work in exactly the
same way as the mod_auth example. She will be presented with a dialog box by her web
browser. If she successfully authenticates, she will be shown the content. If she fails, she
will be given the error page.
For many websites, mod_auth_mysql is ideal. It is fast and relatively easy to implement,
and it allows you to use any convenient mechanism to add database entries for
new users. For more flexibility and the ability to apply fine-grained control to parts of
pages, you might want to implement your own authentication using PHP and MySQL.
Creating Your Own Custom Authentication
In this chapter, you looked at creating your own authentication methods including some
flaws and compromises and using built-in authentication methods, which are less flexible
than writing your own code. Later in the book, after you learn about session control,
you will be able to write your own custom authentication with fewer compromises than
in this chapter.
In Chapter 23, we develop a simple user authentication system that avoids some of
the problems we faced here by using sessions to track variables between pages.
In Chapter 27, we apply this approach to a real-world project and see how it can be
used to implement a fine-grained authentication system.
Further Reading
The details of HTTP authentication are specified by RFC 2617, which is available at
http://www.rfc-editor.org/rfc/rfc2617.txt
The documentation for mod_auth, which controls basic authentication in Apache, can
be found at http://httpd.apache.org/docs/2.0/mod/mod_auth.html.
The documentation for mod_auth_mysql is inside the download archive. It is a tiny
download, so even if you just want to find out more about it, downloading the archive
to look at the readme file is not silly.
Next
The next chapter explains how to safeguard data at all stages of processing from input,
through transmission, and in storage. It includes the use of SSL, digital certificates, and
encryption.