htaccess & php check for authorization

Question

I have an

http://example.com/DL/

directory with free access for anyone, now I wanna to deny access for unauthorized users so I writte very simple index.php with code

<?php
include('config.php');
session_start();
$result = (mysql_query("SELECT * FROM accounts WHERE hash='".$_SESSION['hash']."' ");
$row = mysql_fetch_array(result);
if($row['access']) {
    return true;
} else {
    header("location: /login.php");
}
?>

question: is there way to setup .htaccess to check if index.php returns true every time user request

http://example.com/DL/*

?

Please, don't use mysql_* functions in new code. They are no longer maintained and are officially deprecated. See the red box? Learn about prepared statements instead, and use PDO or MySQLi - this article will help you decide which. If you choose PDO, here is a good tutorial. — Kermit
– Kermit, Commented Mar 24, 2013 at 15:13
ok, but there is no problem with sql right now, for example user request example.com/DL/archive.zip, and I want to check if this user authorized — user840250
– user840250, Commented Mar 24, 2013 at 15:17
The "is no problem right now" mentality will backstab you in the future. You should follow the recommendations by @PolishPrince — baloo
– baloo, Commented Mar 24, 2013 at 15:20
I did changes in my code, thanks for that! no * anymore. What about the main question? — user840250
– user840250, Commented Mar 24, 2013 at 15:28

Community · Accepted Answer · 2017-05-23 12:21:06Z

1

You can use mod_rewrite to make all requests be routed to index.php.
See this example.

This way you can utilize the Front Controller Pattern
Which basically means that index.php will be your router into the other parts of your code. This allows for the access control that you are looking for but also lets you have a good structure of the rest of your code.

Another recommendation is to only expose index.php in your web root and have the rest of your code outside of the publicly visible folder. This way you will also prevent someone from fetching all your code base when you forget to configure apache properly.

edited May 23, 2017 at 12:21

CommunityBot

11 silver badge

answered Mar 24, 2013 at 15:28

baloo

7,7954 gold badges29 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

htaccess & php check for authorization

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related