Code Examples -> This code generates an MD5 protected string, which can be used to hand off to other web pages, or even other sites.

	Submit Your Code
	SEO Monitor
	UpTime Monitor
	PHP Code Contest
	My Favorite Examples
	My Favorite Articles
	Update Your Profile

More Weber Sites
	PHP Code Search
	Web Development Forums
	Learn MySQL Playing Trivia
	PHPBB2 Templates
	Web Development Index
	PHP Web Logs (BLogs)
	Web Development Resources
	Web Development Content

Recommended Links
	PHPClasses
	PHP Editor
	PHP Jobs
	Vision.To Design
	Ajax Tutorials
	PHP Programming Help
	PHP/MySQL Programming
	Webmaster Resources
	Webmaster Forum
	XML meta language
	website builder

Recommended
	Submit Site
	Forex Trading Online forex trading platform


BACK		ADD A COMMENT		SEND TO A FRIEND		ADD TO MY FAVORITES		ADD CODE EXAMPLES		PRINT

PHP Code Examples

Title :	This code generates an MD5 protected string, which can be used to hand off to other web pages, or even other sites.
Categories :	Algorithms, PHP, PHP Classes	Michael Graff
Date :	Jan 17th 1999
Grade :	Be the 1st to grade this Code Example
Viewed :	4759
File :	No file for this code example.
Images :	No Images for this code example.

Search :	More code by Michael Graff
Action :	Grade This Code Example
Tools :	My Examples List

Code

This code generates an MD5 protected string, which can be used to hand
off to other web pages, or even other sites. If someone can read the
ticket, they can use it, so this works best over encrypted connections,
but since the ticket only lasts for a short time (2 hours, definable) I
think it's better than sending a password around.

<?php
// $Id: authticket.phl,v 1.3 1998/02/11 16:45:34 explorer Exp $

//
// Copyright (c) 1998 Michael Graff <explorer@flame.org>
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions
// are met:
// 1. Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// 2. Redistributions in binary form must reproduce the above copyright
// notice, this list of conditions and the following disclaimer in the
// documentation and/or other materials provided with the distribution.
// 3. Neither the name of author nor the names of its contributors may be
// used to endorse or promote products derived from this software
// without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ANY
// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
// DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS BE LIABLE
// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
// LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
// OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
// SUCH DAMAGE.
//

class authticket {
var $secret = "setme"; // you WILL want to change this
var $realm = ""; // the realm of this identity
var $lifetime = 2 * 60 *60; // tickets good for 2 hours
var $authenticated = 0; // the data here is valid iff non-zero

var $identity; // the remote identity, if decoded correctly
var $issue; // the time the ticket was issued
var $remote_addr; // the remote address of the client
var $hash; // the hash value. Probably of little use.

var $autherr; // if verification faild, this contains why

//
// helper function which just zeros out the ticket data
//
function zerodata()
{
$this->authenticated = 0;
$this->identity = "";
$this->issue = 0;
$this->remote_addr = "";
$this->hash = "";
$this->autherr = "";
}

//
// Take a string ($identity) and a time ($time) and the internal
// secret value, and generate a string that can be used to verify
// that the remote user is known to us. The result of this function
// is a single string, that can be passed along in a hidden form
// or even a cookie.
//
// If ($time) is 0, the current time is used instead.
//
// ($identity) _cannot_ contain a ``:'' character. If you need
// one in there, you will have to change it to some sort of escape
// sequence.
//
// Some care should be used. I recommend using this only over SSL,
// unless the actual ticket contents are encrypted using something
// stronger than XOR.
//
function makeauth($identity, $time)
{
global $REMOTE_ADDR;

$this->zerodata();

if ($time == 0)
$time = time();

$ticket_items[] = (string)$time;
$ticket_items[] = $this->realm;
$ticket_items[] = $REMOTE_ADDR;
$ticket_items[] = $identity;

$ticket = implode($ticket_items, ":");

$hash = md5($this->secret . $ticket);

$ticket = $hash . ':' . $ticket;

$this->identity = $identity;
$this->issue = $time;
$this->remote_addr = $REMOTE_ADDR;
$this->hash = $hash;
$this->authenticated = 1; /* data is valid */
$this->autherr = "";

return $ticket;
}

//
// Take a ($ticket) string generated by makeauth(), and a ($time),
// and verify that the ticket is valid and not expired.
//
// If ($time) is 0, the current time will be used.
//
// On error, the function returns the empty string "",
// $authenticated is 0, and $autherr contains the reason
// the authentication failed.
//
// On success, the identity encoded in the ticket is returned,
// $authenticated is non-zero, and $autherr is to be ignored.
//
function checkauth($ticket, $time)
{
global $REMOTE_ADDR;

$this->zerodata();

if ($time == 0)
$time = time();

/*
* Item order: hash time realm remote_addr identity
*/
$ticket_items = explode( ":", $ticket);

/*
* if the remote address doesn't match the one in the ticket,
* drop them.
*/
if ($ticket_items[3] != $REMOTE_ADDR) {
$this->autherr = "Address mismatch";
return "";
}

//
// if we are supposed to check for expired tickets, do that
// here.
//
if ($this->lifetime != 0)
if ($time > (int)$ticket_items[1] + $this->lifetime) {
$this->autherr = "Ticket expired";
return "";
}

//
// make certain that the ticket is not being used before
// it was issued.
//
if ($time < (int)$ticket_items[1]) {
$this->autherr = "Ticket used before issued";
return "";
}

//
// verify that the realms match
//
if ($this->realm != $ticket_items[2]) {
$this->autherr = "Realm mismatch";
return "";
}

//
// This could be done better... Reassemble the components
// of the ticket passed to us, and rehash. Compare this
// to the hash we were sent.
//
$tmp_items[] = $ticket_items[1];
$tmp_items[] = $ticket_items[2];
$tmp_items[] = $ticket_items[3];
$tmp_items[] = $ticket_items[4];

$tmp_ticket = implode($tmp_items, ":");

$hash = md5($this->secret . $tmp_ticket);

if ($hash != $ticket_items[0]) {
$this->autherr = "Integrity check failed";
return "";
}

//
// well, it all checks out. Might as well claim we know
// who this person is.
//
$this->hash = $hash;
$this->issue = $ticket_items[1];
$this->remote_addr = $ticket_items[3];
$this->identity = $ticket_items[4];
$this->authenticated = 1;

return $this->identity;
}
};

?>

Related Code Examples

	A class to put get and post variables in hidden form elements. Works on scalars, normal arrays, associative arrays. Categories : Algorithms, Variables, Arrays, PHP, PHP Classes
	Timer - a class that uses microtime() to provide easy calculation of elapsed times Categories : Algorithms, PHP, PHP Classes
	Password Creator: This PHP code exmaple shows how to use bitwise operations on a single variable and using it as a flagged variable. The class generates passwords of a given length using specified characters and the flags. Categories : PHP, PHP Classes, Algorithms, Security
	Credit Card Identification and Validation Class - The credit_card class provides methods for cleaning, validating and identifying the type of credit card numbers. Categories : PHP, PHP Classes, Credit Cards, Ecommerce, Algorithms
	very simple ftp class Categories : PHP, PHP Classes, FTP
	PHP Paypal IPN Integration Class v1.0.0 Categories : PHP, PHP Classes, Payment Gateways
	Check parameters validity. Paranoia was designed to check the validity of the parameters that a php page will receive after a form submission. It can be used to check the variables sent by POST or GET Categories : Algorithms, HTML and PHP, PHP, Variables
	A Timing Class Categories : PHP, PHP Classes, Date Time
	The class to check load time of your script VERY usefull for relatively slow applications, but not only.. Categories : PHP, PHP Classes, Debugging
	Create HTML forms dynamicly using Javascript & PHP Categories : PHP, PHP Classes, Java Script
	A very simple way to build and do a hierarchical html categories browser without javascript , just using html php and mySql Categories : HTML and PHP, Databases, Algorithms, PHP, MySQL
	usercounter class Categories : PHP, PHP Classes, Databases, MySQL, Environment Variables
	RSS parser. Parses RSS into an array. Quick and nasty but does the job. No checking is done for correct Tags, only correct XML. PHP4 needed to display result (uses print_r). Categories : PHP, XML, PHP Classes, Rich Site Summary (RSS)
	These PHP Classes Check if a host is alive using various methods. Categories : PHP, PHP Classes, Sockets, CURL
	an example of the cyberlib payment class Categories : PHP, PHP Classes, Ecommerce, Credit Cards