0

I developed a website. There is no login section in the website. I didn't want to force people to sign up. Now I have a problem. There are a few .php pages that only I should access. How can I do that? I am afraid that some hacker will find the page and have access to admin functions on the site.

What I did I included this code on the page:

if($_POST['code'] != 'mysecretcode')
   exit("you are not allowed");

Whenever I want to enter that page, I include the code as a POST parameter: http://mywebpage.com/iptracker.php?code=mysecretcode

However, I don't know how effective this solution is.

  • 2
    What have you considered so far? This question seems rather broad the way it is now. – tim Dec 23 '15 at 17:32
  • See stackoverflow.com/a/6810312/721263 - this is a solved problem. – Neil Smithline Dec 23 '15 at 18:35
  • @Webber - Wait! Passing parameters to page visibly within URL is $_GET['code'] and not $_POST['code']! This won't work. – Vilican Dec 23 '15 at 18:36
  • @NeilSmithline This assumes that you already have a user database, which isn't the case here. – Philipp Dec 23 '15 at 18:36
  • I don't think so @Philipp. The session code seems to be separate from the DB code. I believe that you can even use PHP sessions with the admin username/password hardwired into the PHP. Perhaps I'm wrong as I'm not a PHP wiz, but I think that's the case. – Neil Smithline Dec 23 '15 at 18:39
5

The most simple solution would be to protect the files which are part of your admin interface using the http password authentication capabilities of your webserver (like .htaccess on apache). This will prompt you for a username and password via your browser. You rarely see this solution "in the wild" because it's far uglier than logging in through a web-based form, but it's entirely sufficient for private admin backends where beauty doesn't matter.

A solution with an even higher security standard would be to use TLS authentication with both server and client certificates. It means that the connection to the admin portal is encrypted and that the user-authentication works via a certificate in your web browser. Consult the documentation of your webserver for how to set this up. You won't need to get a server certificate from a 3rd party authority (even though you can get them for free now). Because you are the only user, you can simply add your own certificate as a trusted certificate to your web browser.

  • Hadn't thought of this. You probably need to specify that you should use TLS with basic auth. Good answer. – Neil Smithline Dec 23 '15 at 18:41
  • i am a newbie. i am gonna look for TLS. and will use it. thanks. – Webber Depor Dec 23 '15 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.