login, register and remember me script

[MattStan]

Does anyone know of any scripts that can either be downloaded for free of copied and pasted from a web site that will provide me the capability of adding a login to my website?

I want visitors to register for offers and to login to the site to gain access to "members only" pages, but I also want the site to remember them and say "welcome back XXXXXXX"

If anyone knows of any resources I would be very grateful...

[scragar]

you would need cookies to manage this. The only problem I can think of though is the lack of being able to add users and everyone being able to just open up your source code and steal some ones password.

[shkiller]

You do it with php, or any other server side scripting

[MattStan]

Thanks, but I have now found what I am looking for. I found a great little script at http://www.biepenlu.nl/biepenlu/pages/puls.php.

[slaughters]

There should be a sticky note for this subject.

It's impossible for you to use *only* javascript for storing usersnames and passwords in a secure manner. You need a database and server sided scripting.

Your posted link uses both, but if this is also not done via an SSL (https://) connection anyone watching the network traffic to your site can steal usernames and passwords as they are sent to the server.

[lutsen]

This link showed up in my web-statistics. Thanx for posting my script in this forum (http://www.biepenlu.nl/biepenlu/pages/puls.php).

Slaughters, my script does not use a SSL connection, but instead the password is encrypted clientside using Javascript before it is sent to the server. This way it also can not be stolen, without using SSL.

I used the javascript and information on http://pajhome.org.uk/crypt/md5/ to encrypt the passwords.

[MattStan]

Lutsen, You're welcome.

Code seems to work great, but it's a shame you offer no support on your website, as I get an error message when "logging out" as follows:
Warning: session_destroy(): Session object destruction failed in /XXXXXX/XXXXXX/XXXXX.co.uk/XXX/htdocs/puls/logout.php on line 44

Can't seem to fins a fix for it at all !!

Otherwise, the thing works well...

By the way - if you can provide a fix Lutsen, just PM me !!

[lutsen]

MattStan,
I can not reproduce your error myself. I Googled for a solution, and found out it might have to do with your configuration:
Your permissions on the sessiondata directory might be incorrect. PHP cannot delete the session file it has created. Set permissions on C:\PHP\sessiondata\ so that Users (or better yet, IUSR_MACHINENAME) can delete files and that should fix it.
I will also clean up the logout code as mentioned in this thread (http://www.webdeveloper.com/forum/showthread.php?t=126904) in the next release, but I doubt this will fix your problem since the session_destroy function will still be there.
Another (quick 'n dirty) option to "fix" this is to put an "@" in front of the session_destroy function so the error will be suppressed.