Hi,
you can do pretty much anything as long as it makes sense in your specific setup. There's no difference with regard to security (as far as I can tell).
In modern frameworks, for example, you only have a
single script to handle every request. The actual program logic is in the classes. Other websites use the classical approach of "one script per page".
In your case, putting both the content and the login logic into a single script makes no sense to me, because those are two separate aspects. So I'd make one script for the login, one for the account page and a function or script to check the login status on each page you want to protect.
Redirects are done with header('Location: ...'). The login check function would look something like this:
PHP Code:
// call this on top of every protected page
function check_login_status() {
session_start();
if (!isset($_SESSION['user_id'])) { // not logged in? redirect to login page
header('Location: login.php');
die();
}
}
Apart from that: You should definitely replace your text files with an actual database. Flat files are extremely inefficent and prone to data corruption. If, for some reason, you find a fully featured database system like PostgreSQL or MySQL too heavyweight, you can use an embedded database like
SQLite.
And you should not implement your own password hashing schema (as suggested in the link). Use a well tested library like
PHPass instead.
Del.icio.us
Digg
Google
Spurl
Blink
Furl
Simpy
Y! MyWeb
Linear Mode
