会话保护3 [重复]

Question

This question is an exact duplicate of:

• session protection 3 answers

I am creating a webpage bit by bit, testing parts of the webpage ideas. I want to learn how to session protect a page. I have already password protected a page seccsesfully, but anybody can access the page by typing in the url. i want to session protect my page so no one can do that. i have three pages: index.html, which has the form which sends the the password.php, the password.php, which makes sure that the password and username are correct using "if statments"(here is the "if statment")

    if ($username == 'mgmb99'){
    if ($password == 'mgmb91mas'){
    header('Location: youhere.php');
    } else {
    echo 'your username or password is wrong.<a href="http://www.passwordtest.comze.com"> go back to login page </a>';
    }} else {
    echo 'your username or password is wrong.<a href="http://www.passwordtest.comze.com"> go back to login page </a>';
    };

, and the youhere.php which is the page once you logged in.

</div>

Answer 1

there are lots of good examples online. But Session limiting (and database for that matter) are best with salt keys or hashes.

So basically you take an id/username and a random piece of text and (for example) hash it with sha1.

sha1($[your username].'completely random piece of text')

This will give you a 40 character string which you can reproduce if you have the username and the random text. So:

if($SESSION['id'] == sha1($[your username].'completely random piece of text')) { // now you know that the username is correct }

Thats basically it. It does have some more tricks offcourse. But never put anything in the session that could make sence to anyone. So just use public Id's (not user ID's) in the session as well as hashed data.

An example for a simple SESSION is here (did not check it, but its nice to start with): http://www.webdesign.org/web-programming/php/password-protect.11092.html

Goodluck!