SPWD

Okay, when we look at creating effective user access, the first thing we have to look at is the database design. As I mentioned in the overview post of this series, we will not look in-depth at how to connect to a MySQL database, the code will be shown, but not explained. However, we do need to explain a decent table layout, as well as define what tables are needed in our example here.

One thing I should mention is some specifics that I will be basing the rest of this series off of, in others here is the list of requirements I am going to meet. While the list is not extensive or exhustive, it provides a good base to which you should be able to extend to fit your requirements list.

1. The site needs to log users in and out.
2. The site needs to keep users logged in for a minimum of 15 minutes.
3. The site needs to keep users logged longer if they desire to choose “Remember Me”.
4. The site needs to authenticate on all pages.
5. The site needs to logout users by session timeout, cookie timeout and user forced logout.
6. The site should log all login attemps, whether successful or not for security purposes.
7. The site should be able to provide the user with their last login date and time.
8. The site should operate over a secure connection.
9. The site should lock an account after three unsuccessful login attempts, if the account login name is correct and the password is wrong, and it should stop accepting submissions if the user name is not found within three attemps and log the error.

On to the MySQL database definition…..

(more…)

This tutorial requires that several basic sets of knowledge be known by the user already. One is you must be proficient with HTML/XHTML, two is that you already know some basic PHP programming in an object-oriented fasion and three that you know how to connect to a MySQL database using PHP. Why are these required? Becuase this tutorial is not about teaching PHP basics, nor is it about how to connect to a MySQL database. It is not about teaching you HTML/XHTML nor is it about object-oriented program development.

There are several items that you need to figure out before we can continue with our discussion of user access. These items will determine how you implement the user access control. I have listed them below:

• Do all pages on the site need to have user authentication, or only a subset of them?
• Will the site use SSL connections or just basic plain text authentication?
• Will the site offer to “remember” users after the leave the site and come back or automatically log them out when they leave the site or follow the logout button/link?
• Will the site offer content only to those logged in, such as a user control panel where the user may add/change/remove their information or a special section that is dependent upon their access level?

Once those questions are answered, you will find that the tutorials step through first generating the user database that is universal to cover all those needs and more, then we will setup basic authentication using an SSL encrypted page, then we will setup sessions, session time limits, cookies for user rememberance and finally discuss restricting access to pages via user login authorization level.

This is the overview of a several part series that will be posted over the coming days.