The Idea behind PHP authentication (Newb seeking answers)

[kidwithshirt]

I m designing a small web application that displays information that users input. Of course it requires user to register first, then their information would get displayed. The user infos are stored in a MYSQL database, and it will get called on a public page (only editting or adding info needs registeration)

The main thing I m confused about is, how to differentiate (differ? distinguish?) between public page and login-required pages. Would it be the same php script file but with some if...else that checks for logins?

I dont make sense at all

Since I started learning about PHP 2 weeks ago, I still unsure how this will work. If you have any tutorials or tips. Please post

[GhostGambler]

<?php
function require_login() {
  if (!isset($_SESSION['logged_in'])) {
    echo "login-form";
    die();
  }
}

require_login();

outsource the function into a global file and then just call it whenever a login is required ... can be done a lot more beautiful of course, but that's it actually~

[ccRicers]

I'm not certain why you would use die() in the case a user isn't logged in. It makes more sense to continue the "if" statement and call an alternative function in "else", like displaying whatever needs to be displayed for logged in users.

[GhostGambler]

This function is for a site which as a whole requires the user to be logged in.

So you could do something like

<?php
include global.inc;
require_login();
echo the real content of the site, just for logged-in users;

With the die in the function you assure, that the rest of the code is not executed - it's the most easiest way I think~

If you just want to leave out some things for not logged in users or sth. like that, you can just use the good old if

<?php
echo "entry"
if ($_SESSION['logged_in']) echo edit-link;
echo "next entry";

[kyberfabrikken]

Would it be the same php script file but with some if...else that checks for logins?

Yes, that's basically how it works.

You should be aware, that if you have simple login requirements (Eg. all access or no access to certain pages/subdirectories), you can use the web server to manage authentication. If you use Apache (you probably do) for web server, you just have to put a .htaccess file in the directory, where your private scripts are, and put a few lines in it. Google tutorial htaccess for specifics on how.