This is the first step in database websites. Well, I take it as that first step, there are ways you can make logins with text files but these are not really secure, and advanced interaction requires databases anyway so you might as well use this opportunity to bite the bullet.
The basic premise is this: you have a database living on the server called “links_site”. Inside that database is a table called “users”, which contains rows. Each row is one person’s account and like a row on a spreadsheet, it contains their username, their password (this is encrypted, I will talk later about this), last login date, their bio, and whatever other information you want to associate with the user individually.
You then use a scripting language to access that information. I love using PHP but I also use ASP.net quite a lot. PHP and the database program MySQL are free and open source so many people, myself included, use it. Wordpress is built on it too.
So you have your website. For simplicity’s sake, let’s say we’re looking on the main page, index.php (you need to use such extensions to enable the use of such code). It has, in addition to the main page content, a form on it with two fields, a username field and a password field. This is an HTML form and the password field will be made into ***s by designating it as a password. There is also another input element given the type of “submit” which makes the Submit button (again you can rename it in the HTML and style it too).
A note here, there are many ways of doing the following, I am explaining the easiest one and one I learned way back when. When the user presses the “submit” button, the username and plain text password are sent to a next page. That page will be a PHP page with a name like “login.php”. This is where the magic all happens. You use PHP code to create the logic and interact with the database to compare the password given with the one on file. Here’s some pseudo code in regular English:
inside of login.php
-> Via POST*, read in the username and password variables.
-> Connect with the database and request the password on file for the username given.
-> Convert the password you were given into its encrypted form, and compare to the encrypted one you got from the database.
-> If they are the same, ok! The person is who they say they are, log them in by giving them a cookie. (Not a chocolate chip one, a digital one.) Maybe even redirect them to index.php
-> If they aren’t the same, problem. Maybe keep track so that if this happens more than 5 times in a row, you know someone’s trying to crack in to an account.
Let us then go back to index.php. You add interaction to it by inserting more PHP and HTML which is only shown when the user is logged in. To check such things an easy way is the cookie method. A small cookie file is placed on the logged in person’s computer. You can put variables inside of this, such as their username. The index page can access this cookie and read the username, if there is no cookie at all then the person is not logged in. If the cookie has a username, the index page can use this as a variable and call up the proper information for them.
*There are two ways to send data from a website to another via a form, POST and GET. The difference is that GET variables are in the URL, such as index.html?name=jimbo&password=happypants whereas POST variables are not seen in the URL, they are only passed behind the curtains.
I find it is great to know how this all works, in fact it’s important to make secure applications (the one above for instance has a few holes, but is good for learning the basics). But in practice it is not feasible to manually create such systems for each and every application you want to make! This is why @andrew is recommending Django, another one is PEAR, these are support structures which contain all of this stuff prewritten so you don’t have to reinvent the wheel each time and can instead focus on making your site look pretty or functional to the users.
Then again, there’s something to be said for rolling your own login system, especially when all you need is a user and notification system and you don’t want the overhead of installing a helping system as well.
Edit: I accept and value your “dude” and request it not be changed to the politically correct dudette :)
Composing members:
0
Composing members:
0
