PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

570 Chapter 27 Building User Authentication and Personalization
This system should enable users to log in and store their personal bookmarks and to
get recommendations for other sites that they might like to visit based on their personal
preferences.
These solution components fall into three main categories:
n You need to be able to identify individual users.You should also have some way of
authenticating them.
n You need to be able to store bookmarks for an individual user. Users should be
able to add and delete bookmarks.
n You need to be able to recommend to users sites that might appeal to them, based
on what you know about them already.
Now that you know the idea behind the project, you can begin designing the solution
and its components. Let’s look at possible solutions to each of the three main requirements
listed.
User Identification and Personalization
Several alternatives can be used for user authentication, as you have seen elsewhere in
this book. Because you want to tie users to some personalization information, you can
store the users’ logins and passwords in a MySQL database and authenticate against it.
If you are going to let users log in with usernames and passwords, you will need the
following components:
n Users should be able to register their usernames and passwords.You need some
restrictions on the length and format of each username and password.You should
store passwords in an encrypted format for security reasons.
n Users should be able to log in with the details they supplied in the registration
process.
n Users should be able to log out after they have finished using a site.This capability
is not particularly important if people use the site from their home PC but is very
important for security if they use the site from a shared PC.
n The site needs to be able to check whether a particular user is logged in and
access data for a logged-in user.
n Users should be able to change their passwords as an aid to security.
n Users should be able to reset their passwords without needing personal assistance
from you.A common way of doing this is to send a user’s password to him in an
email address he has nominated at registration.This means you need to store his
email address at registration. Because you store the passwords in an encrypted form
and cannot decrypt the user’s original password, you actually need to generate a new
password, set it, and mail it to the user.