Creating a basic login-required page

Question

My intention here is to create a page which initially displays a basic form consisting of a text field where a password is entered, and a submit button. Upon submitting, the form will send the value back to the same page, where it is checked. This happens in the PHP file, not in a database. If the password is correct, the relevant HTML will be shown. This is what I have:

<?php
    ini_set('display_errors',1);
    ini_set('display_startup_errors',1);
    error_reporting(-1);
    if(isset($_POST["logout"])){
        session_destroy();
    }elseif(isset($_POST["auth"])){
        if($_POST["auth"]=="password"){
            session_start();
            $_SESSION["admin"]="true";
        }
    }
    if(!isset($_SESSION["admin"])){
?>
    <form action="/admin.php" method="post">
        <input type="text" name="auth"><input type="submit">
    </form>
<?php
    }elseif($_SESSION["admin"]="true"){
?>
<section>
<!--HTML goes here-->
</section>
<section>
    <form action="/admin.php" method="post">
        <input type="hidden" name="logout" value="logout">
        <input type="submit">
    </form>
</section>
<?php }else{echo "Incorrect password";}?>

Now this partially works. Entering the correct password will show the HTML that the person should see. What doesn't happen is when an incorrect password is entered, the echo on the final line will not be shown. It just goes back to the form, as if opening the page for the first time.

Also, after successfully entering the password, I get a couple of warnings thrown up:

Warning: session_start(): Cannot send session cookie - headers already sent by (output started at D:\xampp\htdocs\top.php:28) in D:\xampp\htdocs\admin.php on line 13
Warning: session_start(): Cannot send session cache limiter - headers already sent (output started at D:\xampp\htdocs\top.php:28) in D:\xampp\htdocs\admin.php on line 13

...where line 13 is simply session_start();

While I have read that there are security issues with storing a password in the PHP file, it didn't seem like a major concern since no more than two people will be using this page containing tools for the manipulation of things that aren't a major issue if messed with, or deleted. However, if this is a much bigger security issue than I think it is, please let me know.

Answer 1

It is adviced that session_start() should be the first line of the code, you can start session with all the users, but use some other data stored in session variables to authenticate and authorize the access.

Answer 2

For the warnings below you can add <?php ob_start(); ?> at the top of the page. Doing so should probably get you out of those warnings .

Answer 3

Add the included files after session headers.I dont see any use of included files in the php code posted in the question guessing they are needed after in that page.So just add them after session headers and this will and most probably should solve your problem

OR

Add this line to your php.ini:

output_buffering = On

PHP docs recommend setting to a number instead of just On >> http://us3.php.net/manual/en/outcontrol.configuration.php#ini.output-buffering.

OR

In .htaccess add:

php_value output_buffering On

Source : session_start() error

Answer 4

session_start();

When the password is incorrect this line of code never get executed unless the form is posted with a correct password.

Place that line at the top and remove it from where it is now.

Answer 5

Here is some code that is based on your original code.

It is tested.

There was a bug in one of your original tests that had '=' rather than '=='.

As you are using PHP to select different portions of the HTML to include i have used the 'Alternate Control' syntax as it reads better.

There are quite a lot of comments in the code. Feel free to remove 'em. :-)

<?php
// PHP 5.1.18 on windows XP (XAMPP) -- i use buffered output    
session_start(); // assume we always have sessions -- can be destroyed later if required

/*
 * Using Alternate Control syntax for control structures
 *
 * This is 'cos we are using PHP to show different portions of HTML
 */

$passwordError = false; // assume password is ok


// I have these already in my development enviroment
//    ini_set('display_errors',1);
//    ini_set('display_startup_errors',1);
//    error_reporting(-1);

    if (isset($_POST["logout"])) { // logout form submitted...
        session_destroy();
        die(__FILE__ .' : i am done...');

    } elseif (isset($_POST["auth"])) { // hard coded password! fine for testing!
        if ($_POST["auth"] == "password") { 
             $_SESSION["admin"] = "true";
        } else {
             $passwordError = true; // failed password check
        }
    }
?>

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <title>Q22131957</title>
  </head>

  <body>
    <h1>Q22131957 Login screen</h1>

  <?php if (!isset($_SESSION["admin"]) || $_SESSION['admin'] != "true"): // need the admin login form to be shown?>

    <form action="" method="post"> <!-- the form must come back to this script for checking... -->
        <input type="text" name="auth"><input type=submit value="admin login">
     </form>

     <?php if ($passwordError): ?>
        <strong> Incorrect password</strong>
     <?php endif; ?>

   <?php endif;  // end of admin attempt to login... ?>


  <?php if (isset($_SESSION["admin"]) && $_SESSION["admin"] == "true"): // admin is logged in successfully ?>

  <!--
    /*
     * Normally, you would just redirect to a different URL where
     * all the admin actions live.
     *
     * Here i just drop through to the 'logged in admin' part of the script
     * as the original script did.
     *
     */
  -->
<section>
 <!--HTML goes here-->
  <p> we logged in as ADMIN! </p>
</section>
<section>
    <!-- this form returns to this script! -->
    <form action="" method="post">
        <input type="hidden" name="logout" value="logout">
        <input type="submit" value="logout">
    </form>


    <!-- divert to admin.php screen via a form -- testing only -->
    <form action="admin.php" method="post">
        <input type="hidden" name="continue" value="continue">
        <input type="submit" value="continue to admin.php...">
    </form>

</section>
<?php endif; // end of successful logged in admin ?>

</body>
</html>