PHP Authentication

[Ben643]

Sorry about posting another PHP thread! It may be another one I'm crap at explaining too.

Right, I've got a working registration and login page but now I actually need to setup a "check" for each restricted page to see if the user is authenticated.

So far I've just got this included on each page I want to be restricted but I was hoping for a more elegant solution which I didn't have to remember to include each time:

if(!isset($_SESSION['auth']) || $_SESSION['auth'] != 1){
	die("not authorised");
}

I've only got 3 pages which don't need authentication - they are /login, /register and the index /. I was thinking maybe it would be easier to deny access unless it's either of these 3 pages (or if the user isn't logged in).

Is this is an acceptable idea? and if so, would anyone be able to give me a hand implementing it?

I've now got everything going through a "singe point of entry" which should be an ideal place to do the check but I can't figure out the final part of actually checking which page the user is viewing.

Any help would be appreciated.

 

[Ben643]

Thanks for the reply. Yeah I'll definitely be using a framework for my next project, I've heard really good things about them. Unfortunately this was a project I'm working on at uni and I'd already done quite a bit by the time I'd heard how brilliant frameworks are.

I've been using the MVC design patten though, so I do have a base controller which everything inherits from.

I managed to get it working by putting this in my single point of entry page... not sure if it's "good practice" but it seems to be working fine so far.

auth.txt

Basically if they haven't logged in and got a session set up and if it's not one of the pages in the array, deny access.

 

[Ben643]

Can you reccommend a framework for this kind of thing please?

I've heard a lot of people recommending the Zend framework. It's widely used and support should be easy to find.

Really wish I'd known more about frameworks when I started this project though!