This tutorial teaches you how to write and use classes, to make your PHP code more flexible and easier to manage. The tutorial guides you through the construction of a simple, security-related class that performs some basic security functions for a web site: checking user logons. The class implements security features that answer some needs for a number of current security models and could be easily implemented at most dynamic Web sites. Note that this class does not provide a full security solution. The example presented in this tutorial addresses a rudimentary yet effective form of web hacking: manually modifying the URL in the browser window. Among the many ways to hack, this is one of the easiest, but still a difficult one to defend against. Someone with the wrong intentions can potentially change prices or gain access to areas of the site where they aren't authorized; either by modifying the query string after the URL, or by saving the HTML somewhere and modifying hidden variables in the code. Prevention of this type of hacking is particularly important in straight-line applications. A straight-line application is one where pages must be filled out and followed in order, such as e-commerce order forms, registration, and private areas such as web mail.
|