PHP/MySQL FOSS for managing user sessions on the web?

CoderMan · 04-24-2009, 06:51 PM

Hi. My co-worker and I are working on this robotics project where robots are controlled over the web. I don't want to go into all the details, but basically the users visit a page where they have access to a PHP-based interface that allows them to send commands to robots in our tech lab (via an intermediate server). Our web server is running Apache.

Anyway, now we need to implement session control, with user-names and passwords so that only certain people can have access to the interface at a certain time, with access to only certain robots, et cetera. We were hoping there was some kind of pre-fab FOSS solution for handling both the session control and maintaining the MySQL user/password database.

My co-worker knows a little PHP, and I know a little MySQL, but we are both noobs enough that we would prefer to do as little of this from scratch as is possible. We don't have a lot of time, and I know it is easy for inexperienced MySQL programmers to introduce security vulnerabilities.

If anybody could give us any tips to point us in the right direction, that would be great.

paulsm4 · 04-25-2009, 01:18 PM

Hi -

Yes, it's very do-able ... and probably a lot easier than you might think.

STRONG SUGGESTION:
Take "baby steps":

Quote:

1. Familiarize yourself with basic PHP
a) There are countless tutorials on the web
b) Book recommendation (lousy title; great material):
"Teach Yourself PHP, MySQL and Apache in 24 Hours", Julie C. Meloni

2. Once you've written and tried out a PHP "hello world" or two, then try out mySQL from PHP. It's easy!

3. Early on, try PHP "classes". Think about how you can use PHP classes in your web app.

4. Sessions basically come "for free" with PHP. Try it.

5. There are lots of ways to do authentication, but for your purposes, it's probably easiest to store your usernames and (pre-encrypted) passwords in mySQL. Again: Meloni's book will be a big help.

6. You've got lots of different choices for communicating between the Apache web server and your robot ... but maybe the easiest/most robust way is to simply use mySQL. The web app will receive and authenticate commands, and write them to mySQL. Some other, external app will poll MySQL and forward them to the robot.

Bottom line: you've got lots of choices. Better yet you've got lots of relatively *easy* tools that can give you a *clean* solution. Just K.I.S.S, take small, simple steps ... and have fun!

IMHO .. PSM

PS:
Just because somebody's created a pre-fabricated package that superficially *looks* like it might work, doesn't mean it necessarily *will*. Nor does it mean that a) getting up to speed with the package, b) testing it to make sure it'll do what you need, and (possibly) c) adapting it to make it do what you need won't be less effort than just doing it yourself.

The smart thing to do is to familiarize yourself enough with the basic tools (here, PHP and MySQL) well enough that you *can* build it yourself (if you need to), but can intelligently assess whether a prebuilt package really meets your needs (should you *choose* to use it).

IMHO