User Authentication with patUser (part 1) - Breaking It Down
(Page 5 of 7 )
Let's take a closer look at the code to see how this works.
1. The first step is to include the patUser class in your script:
<?php
include("../include/patUser.php");
?>
patUser uses the patDbc class to connect to the user
database, and the patTemplate engine to render its pages - so let's include those as well here:
<?php
include("../include/patDbc.php"); include("../include/patTemplate.php");
?>
2. Next, the database layer needs to be initialized. This is
accomplished by creating an instance of the patDbc class and providing it with the access parameters needed to connect to the MySQL database holding the user data. This object instance is stored in the PHP variable $db.
<?php
$db = new patMySqlDbc("localhost", "db111", "us111", "secret");
?>
3. Once the database connection has been initialized, the
patTemplate engine also needs to be initialized. Here too, an instance of the patTemplate class is created, and provided with the location of the directory containing patUser's templates.
<?php
$tmpl = new patTemplate();
$tmpl->setBasedir("../templates");
?>
If you look in this directory, you'll see two templates,
named "patUserLogin.tmpl" and "patUserUnauthorized.tmpl". The first of these templates contains the login box that is displayed whenever the system requires user credentials, while the second contains a generic "access denied" page that is displayed when an attempt is made to access a restricted page without appropriate privileges. Both these templates are included as part of the patUser distribution, and you are free to make changes to them so that they fit into the look and feel of your application.
4. Once both template engine and database connection are awake, it's time to initialize the patUser class itself.
<?php
$u = new patUser(true);
?>
The "true" argument to the class constructor tells patUser to
use PHP's session management capabilities to store user data in the session.
Once the object instance has been initialized, the methods setAuthDbc() and setTemplate() are used to connect it to the database connection and template engine respectively. patUser will use this information to send queries to the database and render page templates as needed.
<?php
$u->setAuthDbc($db);
$u->setTemplate($tmpl);
?>
The four steps above are fairly standard for all scripts
using the patUser class, and so it's a good idea to encapsulate them into a single function, say init(), and call that function at the start of every script so as to eliminate unnecessary repetition. A single init() function reduces redundancy, and also makes changes easier.
Once all the formalities are concluded, the requireAuthentication() method may be called to verify the user's credentials.
<?php
$u->requireAuthentication("displayLogin");
?>
This method tells patUser that what follows is a restricted
page, and access should only be allowed if appropriate user credentials are available. In case these credentials are not available in the session, patUser will automatically display the contents of the "patUserLogin.tmpl" template, usually a login box. Once user credentials have been submitted, patUser will internally verify them and either permit access or display an error message.
The actual mechanics of the authentication are performed internally and automatically by the requireAuthentication() method, and you don't really need to worry about it - although if you're really interested, feel free to pop open the class file and inspect the code.
By encapsulating the business logic of user verification into a single function, patUser makes life much easier for the harried application developer - all that's needed is to add a single function call at the top of all such sensitive pages, and patUser automatically takes care of the rest.
Next: A Different Realm >>
More PHP Articles
More By icarus, (c) Melonfire
/ 15 
