Following up on "Implementing One-way Encryption in PHP," my previous tutorial about using one-way encryption to build a secure online diary application, this article explores using PHP encryption for login authentication. It presents the two scripts that make up the diary application: the login and diary scripts, as well as the necessary database server connection script.

His script example shows how to use the md5 hashing function to compare passwords with the ones in the database as well as a modification that uses the mcrypt libraries to encrypt some sample text.

Once we have the user we need to authenticate the details they have submitted. To do this the usual approach is to query a 'user' table in your database to check the corresponding username and password.

This is fine in most situations, but as systems scale we often find that maintaining this user table with current user/passwords can be a lot of trouble. Often in larger systems and organisations usernames and passwords are controlled centrally. This can be in the form of a directory service, such as LDAP. Some situations you may even use a RADIUS, SAMBA, PASSWD style or POP3.

Instead of trying to create all of the above connections, they suggest using the well-established PEAR::Auth package. They even link to a method of getting it installed on a shared hosting platform. TO finish it off, they include a reminder to always asses the security of your application, and suggest keeping an eye on the PHP Security Consortium's SecurityFocus Newsletters for the latest PHP security-related issues.]]> Tue, 04 Apr 2006 07:29:22 -0500