Reply
Mon 29 Sep, 2003 09:12 am
Can anybody give me the HTML code or show me how to create password protected pages? or how to do login pages?
There are many ways.
If it is done in the HTML the password protection would take me less than 3 seconds to crack.
If you want a real solution you will need much more than HTML.
What kind of server will it be on?
hi Craven de Kere,
what do you mean the server?
can you give me some examples?
i just do it in HTML.
Server is like asking if you are on a windows machine, unix/linux machine.
Who is your host? It should tell you on their what server you have... You cant do it in just html, you can however use javascript.
Read this post for information about how to do it:
http://www.able2know.com/forums/viewtopic.php?t=11793
BobbyDouglas, your posts really help, thanks.
renew,
What I meant is that a password in the html can be seen by anyone who wants to see it. HTML is a client-side language which means all the html is passed on to the user's computer and executed there. Javascript is also client-side.
So if you use a client-side method to password protect a page it would take me less than 3 seconds to circumvent it.
I can give you some scripts for this but cracking your password protection as easy as turning off javascript or looking at the source.
For a more secure method you need to use a server-side authentication and you can integrate it with a clien-side language like with the script I posted to B.D. on his thread.
i will look through the thread, thanks.
Remember taht the tread talks aboutr how to integrate .htaccess passwords into webpages. The actual password protection is server side and is not discussed there.
For protection of the web pages you need a script using any server-side language.
If you are familar with web progamming, you can create it by yourself. When i worked as a web-designer i used this algorithm:
1) Validation user input of password and username. We just compare what is in the db. If everything is OK, we go to stage 2, otherwise - access denied.
2) We generate random id (random value) and save this id both at db and at the client side (in cookie or session varaible).
3) When user try to access to authorized pages, we check the id. If client id (cookie or session varaible) = server id (from database), we let the user to access, otherwise we redirect to the error page.