How to implement user verification using PHP+APACHE-PHP Tutorial-php.cn

站 On a professional web platform, users often need the account and password of users, that is, the actions confirmed by identity. The early NCSA httpd server did not provide this user authentication function, and Webmaster could only manually create an identity authentication CGI program.

Most web servers since CERN httpd have provided the function of user identity verification. Although the settings of each web server are different, the settings are similar.

The following are the user authentication settings on the Apache server.

<Directory /home/MyMember> 
AuthType Basic 
AuthName MyMember 
AuthUserFile /usr/local/MyMember.txt 
Options Includes ExecCGI 
<Limit GET POST> 
require valid-user 
</Limit> 
</Directory>

Copy after login

In this example, when the user views all the files in the MyMember directory, including image files and other various files, the user's account and password are required to confirm. The user's account and password files exist in /usr/local/MyMember.txt.

The account password file /usr/local/MyMember.txt may look like the following example. The string before the colon is the user account, and the string after the colon is the password that has been irreducibly encrypted. The encoding generally uses traditional DES encoding. The first two characters of the password are characters similar to seeds (salt). In this case it's all 3P. Each row represents a user. Of course, the Webmaster must control the situation of duplicate accounts by itself. What is special is that when Apache is launched on a Win32 system, the password after the colon cannot be encrypted because Win32 does not provide encoding in this area
API, so the user password exists in clear code.

john1234:3PWudBlJMiwro  
queenwan:3PFNVLNPN9W0M  
noname00:3PEsXaJx5pk7E  
wilson49:3PjoWb0EnaG22  
rootboot:3PIt0snI6.84E  
sun_moon:3PvymMeNOc.x.  
nobody38:3PbskPKwV94hw

Copy after login

On Apache version 1.3.6, you can use ~apache/bin/htpasswd to generate a single account and password, but for commercial websites that require large amounts of data, you may need to write your own program to handle it. On UNIX a call to crypt() is required to handle encoding.

After everything is set up, a password verification window will appear in the browser when connecting. The picture above is the user verification mechanism of SEEDNet's MySEED website. After entering the account number and password, the browser will encode it with BASE64 and transmit it to the server. Of course, BASE64 is only encoding but not encryption, so the security of this kind of transmission on the Internet is still not high. It may still be intercepted by the executioner in the middle and then restored to BASE64. This is also the most flaw in the entire user authentication. Perhaps This problem can be solved by supporting digest authentication (Digest) and using md5 encoding in the future. After that, each page still requires an account and password, but the browser will automatically send it out for you, so you don’t have to enter your account and password anymore. This aspect will be retained until the browser is closed, and you will still need to enter it for the first time next time you re-execute the browser.

When the number of users is small, it is easy and trouble-free to use the above method. However, when there are tens of thousands or even hundreds of thousands of users, the efficiency of the entire server will be dragged down by searching for account passwords, and it may take tens of seconds to minutes to read a page. In this case, it would be unwise to use the password checking mechanism provided by the server. You may be able to use NSAPI to develop your own checking methods on Netscape EnterPRise Server, and you can also use ISAPI filters to develop on IIS. It is always tiring to write C/C++ programs to call NSAPI/ISAPI. There is another choice in PHP, which is also the theme of this section.

PHP’s HTTP related function library provides the header() function. Many web server-client interactions can use this function to do magic. For example, adding the following program at the beginning of a PHP page, that is, the first or second line, can redirect users to the author's webpage.

<?php  
header("Location: http://wilson.gs");  
exit;  
?>

Copy after login

Of course, the HTML text or PHP program after the above program will never appear on the user side.

For the same reason, we use header() to perform user authentication tricks. You can send a string to the user at the beginning of PHP, and the window shown below will appear on the user.

<?php  
Header("WWW-Authenticate: Basic realm="Member"");  
Header("HTTP/1.0 401 Unauthorized");  
?>

Copy after login

在程式中字串 realm="Member" 中的 Member 字样出现在图中，当然若使用中文字取代，浏览器端也会出现中文字，如上面的 MySEED 图。若 Web 站台使用者还有其它语文，如英文或日文，送出中文的 realm 字串似乎就比较不合适。无论如何，这都要视站台的性质及使用者定位而决定。

当然这还是很粗糙，因为除了送出视窗后，就没有下文了，帐号输入正确也好，输入错误也罢，都不会有任何的结果。我们需要再更进阶的程式来处理。

在后端的使用认证上，考虑使用资料库作为储存帐号及密码的后端，在这种架构可以容纳许多的使用者，管它一万个使用者还是十万个使用者。若您的站已有数十万个使用者帐号，那么恭喜您，您的站算是世界级的大站了。MySQL 是个不错的选择，许多站台，甚至是商业化的站台都用它来做后端的资料库。当然您要架真正的商业站台，钱不是问题的话，那可以使用口碑最广的 Oracle 资料库系列。

要在 PHP 中使用任何资料库，都要先将资料库的伺服器端及客户端设定好，之后才编译 PHP 及 Apache 系统。

准备好 MySQL 及 PHP 之后，先在 MySQL 中加入新的资料库，本例是加入mymember，用别的名字当然也可以。MySQL 要加入资料库 (Database) 很容易，只要在MySQL 存放 Database 的地方 mkdir 就可以了。例如在 UNIX Shell 下打

hahaha:/usr/local/mysql/data# mkdir mymember

Copy after login

在建立了资料库之后，尚需要建立资料表格 (Table) 方能使用。设定的表格如下，可以将它储在 /tmp/memberauth.sql 中

CREATE TABLE MemberAuth (  
Serial mediumint(9) NOT NULL auto_increment,  
Username char(8) NOT NULL,  
PassWord char(8) NOT NULL,  
Enable char(1) DEFAULT ’0’ NOT NULL,  
PRIMARY KEY (Serial)  
);

Copy after login

档案 memberauth.sql

先看看 memberauth.sql 的这些栏位。Serial 是个自动增加的整数栏位，每输入一笔资料，就会自动加一，这当然不能是空的栏位，于是就用 NOT NULL 了。第二个栏位是 Username，代表使用者的帐号，为了统一以及适应各系统起见，设定成八个字，当然这个栏位也不能是空的。Password 是第三个栏位，为使用者的密码。第四个栏位 Enable 做为帐号是否有效的旗标，设计上 0 表示无用，1 表可用，日后还可加入其它值做不同的用途。

设计好了资料表之后，就要将资料表加入资料库了。由于常要使用 MySQL 资料库，可以到 http://www.phpwizard.net/phpMyAdmin 下载 phpMyAdmin，使用浏览器操作及管理 MySQL，轻松又方便。若使用这套 phpMyAdmin 可以在它的使用者介面上输入memberauth.sql 加入 MySQL 中。或者也可以在 UNIX Shell 下输入下式，也是有同样的效果。

mysql mymember < /tmp/memberauth.sql

Copy after login

在准备好了之后，就可以输入使用者帐号及密码在 memberauth 资料表中了。当然还是使用 phpMyAdmin 方便，用 mysql 程式就要一笔笔的 INSERT 了。

接着进入了设计函式的阶段了。

<?php  
file://---------------------------  
// 使用者认证函式 auth.inc  
// Author: Wilson Peng  
// Copyright (C) 1999  
file://---------------------------  
$error401 = "/home/phpdocs/error/401.php";  
if ($PHP_AUTH_PW=="") {  
Header("WWW-Authenticate: Basic realm="超金卡会员"");  
Header("HTTP/1.0 401 Unauthorized");  
include($error401);  
exit;  
} else {  
$db_id = mysql_pconnect("localhost", "myid", "mypw");  
$result = mysql_db_query("mymember","select password, enable  
from MemberAuth where username=’$PHP_AUTH_USER’");  
$row = mysql_fetch_array($result);  
$MemberPasswd = $row[0];  
$MemberEnable = $row[1];  
if ($MemberEnable==0) {  
echo "您的帐号被停用了";  
exit;  
}  
if ($PHP_AUTH_PW!=$MemberPasswd) {  
Header("WWW-Authenticate: Basic realm="超金卡会员"");  
Header("HTTP/1.0 401 Unauthorized");  
include($error401);  
exit;  
}  
}  
?>

Copy after login

<? require("auth.inc"); ?> 。

Copy after login

在加入本程式的 PHP 档案都会检查帐号密码，图片等就不会检查，比起使用 Web 伺服器功能的某目录下全都检查，PHP 显得有弹性多了。

$error401 = "/home/phpdocs/error/401.php";

Copy after login

这行表示在使用者按下取消，或检查失败时，要显示给使用者看的档案。

if ($PHP_AUTH_PW=="") { 
Header("WWW-Authenticate: Basic realm="超金卡会员""); 
Header("HTTP/1.0 401 Unauthorized"); 
include($error401); 
exit; 
} else

Copy after login

到 else 之前，若没有传入密码，则送出输入密码的视窗。其中的
$PHP_AUTH_USER、$PHP_AUTH_PW 是 PHP 中特殊的变数，分别代表使用者确认的帐号及密码。上面的程式也是利用这二个变数来处理使用者认证。

$db_id = mysql_pconnect("localhost", "myid", "mypw"); 
$result = mysql_db_query("mymember","select password, enable from 
MemberAuth where username=’$PHP_AUTH_USER’"); 

$row = mysql_fetch_array($result); 
$MemberPasswd = $row[0]; 
$MemberEnable = $row[1];

Copy after login

若使用者有输入帐号及密码，则向资料库查询。同时查核该使用者是否仍可使用。

if ($MemberEnable==0) { 
echo "您的帐号被停用了"; 
exit; 
}

Copy after login

上四行程式为帐号被停用的情形。

if ($PHP_AUTH_PW!=$MemberPasswd) { 
Header("WWW-Authenticate: Basic realm="超金卡会员""); 
Header("HTTP/1.0 401 Unauthorized"); 
include($error401); 
exit; 
}

Copy after login

密码错误则再次向使用者要求输入帐号及密码。

在实际使用时，可以视需要加入的网页再加入 auth.inc 这个档案，就不用连看张图形也要查一次密码，降低伺服器和使用者二端的资源。当然，和 MySQL 的连系上，可以使用 mysql_pconnect() 一直和 MySQL 伺服器连线。或是使用mysql_connect() 每次重新连线，用这个函式要记得早点使用 mysql_close() 将资料库关闭。下面的程式 auth1.inc 是另一版本的认证程式，就是开启连线后马上关闭，释放资源的例子。

Copy after login

以上就是PHP+APACHE实现用户验证的方法的内容，更多相关内容请关注PHP中文网（www.php.cn）！