[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: PHP and user login stuff
-----BEGIN PGP SIGNED MESSAGE-----
On Fri, 12 Feb 1999, Micah Yoder wrote:
> Quiet here today. Are people coding?
Unfortuneately, no. I've been busy parting out my '67 Fastback GT/A after
my brother totalled it Saturday night. That and I have to go buy a new
car... As you might imagine, I've been pretty busy taking care of that.
If anyone you know needs a strong C4 tranny or a 351 Windsor (~375 HP)
with only 13,300 miles on it send them my way.
> I am working on the user signup form. I was hoping to have it up by now
> but hacking through it all is a little slow. Anyway, a preliminary
> version should appear soon, hopefully tonight or tomorrow.
Cool.
> Also, I've devised a script called connect.php3. It is intended to be
> included from other PHP scripts, so we don't have to repeat the
> connection commands in each one. After including it, the PHP program
> can simply reference $conn to do any database stuff.
Wow, code reuse. We're almost sounding like we know what we're doing. :-)
> As an added bonus, there is a LOT of stuff we can add to connect.php3,
> like user and permissions checks. For example, we would be able to
> write a PHP program like this:
>
> $rolecheck = 4; // or whatever, see below
> include "connect.php3";
>
> connect.php3 would check to see if $rolecheck exists. If it does, it
> would verify that the currently logged in user has access to that
> specific role. If not, it would exit and the PHP program would not
> run. This way we wouldn't have to write a check in every script.
>
> If we keep stats on user logins, how are we going to determine when the
> user logs in? If he uses a form, it's easy, but if he uses cookies, he
> wouldn't necessarily have to go to a certain page. And I'd rather not
> have to keep statistics on EVERY page a logged in user views. Just the
> number of sessions. Is there an efficient way, for example, to
> determine the first time a user uses the system every day?
Sounds like a good reason not to use cookies. :-) There are easy ways to
keep state once someone logs in that doesn't require cookies. And if you
have a single point of login it becomes easy to track. Once they leave
our site, they'll have to log in.
> On the subject of users, what if they don't have cookies enabled? Will
> they have to type their login info EVERY time they do anything, or
> should we use HTTP authentication or GET/POST variables (which would be
> cleared every time they visit a static page)?
We definately can't count on people allowing cookes. Even if a machine
"appears" to accept cookies, doesn't mean you'll be able to read them
later. I know people (such as myself) who symlink their cookie file to
/dev/null.
- From the sound of it, we're going to have them login via a form, not HTTP
auth. Of course then as you point out, static pages become a problem.
So, now you have to have every page generated dynamically. That's not
actually a problem with mod_perl. Sure, an all dynamic site has
performance problems with lots of people, but we already know we can get
more hardware when we need it. Besides right now our biggest problem is
getting a site up and running, not that we have too many people using it.
(Now that's the kind of problem I'd actually like to see.)
Basically we need a system that works for *everyone* on any browser. Some
browsers don't even support cookies, and many people dislike them and
hence turn them off. So why bother with writing the code to support
cookies when another solution is more cross platform. IMHO cookies just
mean more work and don't buy us much; if anything.
Getting off my soapbox...
- --
Aaron Turner | Either which way, one half dozen or another.
aturner@pobox.com | Check out the Red Hat Linux User's FAQ Online!
www.pobox.com/~aturner | http://www.pobox.com/~aturner/RedHat-FAQ/
All emails from this account are PGP signed. Lack of a signature is "bad".
PGP Key fingerprint = FB E1 CE ED 57 E4 AB 80 59 6E 60 BF 45 1B 20 E8
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBNsTvljM3jpXy1kJtAQG7OwP/XnhHBzXQ7jxy6IWDZbFTHCDHzMclWXNZ
IR6IxEIZviATGKB1d6KHW0nZHFx0BB+KQ9KVhaV40QTGpg9KEv9ErFGnPSMrNJqi
JKG/NHuC6x6osOEbuvtAMxPWStF4lrpfoDCqoSpvdCFkJuyRdf4Gtv43fjIQ4xPk
yq3e05VvOBI=
=Aj2F
-----END PGP SIGNATURE-----