>> PHP: Access Control & Security

Authentication: Source Authentication Source Hard-coded File-Based The username and password is available inside the PHP page External Database The username and password information is stored on a file on the server. Stored in an external database TRY NOW 1.Open phpMyAdmin 2.Create a new table called user with fields: username, password 3.Add one row with the username and password for the admin 2 Web-Based Systems - Misbhauddin

Authentication: Prompt Authentication Prompt PHP Method (built-in) Use the header() function to send an "Authentication Required" message to the client browser User Designed The designer/developer implements the form that prompts the user for the username and password 3 Web-Based Systems - Misbhauddin

PHP Built-in Authentication 2. Authentication Required 2. return $_SERVER 3. Pop-up form 1. Parse the php file PHP_AUTH_PWPHP_AUTH_USER $_SERVER header('WWW-Authenticate: Basic realm="My Realm"'); header('HTTP/ Unauthorized'); 4 Web-Based Systems - Misbhauddin

Authentication: Access User Recognition Cookies Returned and stored in the user's browser Sessions Session data is stored on your web server (often stored in a public temporary directory on the server) Life span of a cookie can be set to almost any duration Sessions have a predetermined short life (depends on php config) 5 Web-Based Systems - Misbhauddin

Cookies Steps Step 1: After checking if the username/password is correct, set the cookie setcookie (name, value, expire) Expire automatically when the user closes his/her web browser Step 2: On each secure page, retrieve and check whether the cookie is set $_COOKIE[name] Step 3: On logout, unset the cookie setcookie (name, value, expire) Set the value to “ “ Set to a value in past 6 Web-Based Systems - Misbhauddin

Sessions Steps Step 1: Before you can begin storing user information in your PHP session, you must first start the session session_start(); Step 2: After checking if the username/password is correct, set the session $_SESSION[name] = value; Step 3: On each secure page, retrieve and check whether the session variable is set Step 4: On logout, unset the session variable & destroy the session unset($_SESSION[name]); session_destroy(); 7 Web-Based Systems - Misbhauddin

ENCRYPTION PHP

MD5 MD5 (Message-Digest) takes as input a message of arbitrary length and produces as output a "fingerprint" or "message digest" of the input 32 hex digits (128-bit) Based on the RSA Algorithm 9 Web-Based Systems - Misbhauddin MD5(‘w3resource’) = b273cb2263eb88f61f7133cd308b4064 Storing in the database INSERT INTO users (username,password) VALUES (‘$user','md5(‘$password'))’ Using in PHP if (md5($pwd) == value returned from the DB)

AES AES (Advance Encryption Standard) function encodes the data with a 128 bits key length but it can be extended up to 256 bits key length 10 Web-Based Systems - Misbhauddin AES_ENCRYPT(str, key_str); Encryption INSERT INTO user VALUES (‘$user’, AES_ENCRYPT('mytext','passw')); Decryption if (AES_DECRYPT($pwd,key) == value returned from the DB) Encryption Key String Input AES_DECRYPT(crypt_str, key_str); Encryption Key Encrypted Text