0

I'm trying to add a password protection form to index.php so people cannot enter the website without a password. I don't want to use htaccess for visual problems of htaccess.

<?php
    if( !empty ($_POST['password'] ) ) {
        $password = "1234";
        $pw = md5($_POST['password']);
        $valid_password = md5($password);
        if( $pw != $valid_password ) {
            echo "Error! You do not have access to this websitesite.";
        } else {
            require(dirname(__FILE__).'/config/config.inc.php');
            Dispatcher::getInstance()->dispatch();
        }
    }else{
        echo '
        <h2> Please Type Your Password to Enter to the website. </h2>
    <form name="monkeybusiness" method="post" action="\index.php">
      <input type="password" id="password" name="password />
      <input type="submit" id="submit" value="Enter" />
    </form>';
    }

but when enter the password I'm getting following error;

Forbidden

You do not have permission to access this document.

Does anybody know what is the reason of this error? Thanks.

Erdem Ece
  • 1,755
  • 5
  • 22
  • 42
  • Better use [htaccess password protection](http://www.htaccesstools.com/articles/password-protection/) – B001ᛦ Jul 12 '16 at 11:49
  • You can also use session – Tayyib Cankat Jul 12 '16 at 11:51
  • "visual problems of htaccess"???? – Jay Blanchard Jul 12 '16 at 12:00
  • You really shouldn't use [MD5 password hashes](http://security.stackexchange.com/questions/19906/is-md5-considered-insecure) and you really should use PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html) to handle password security. Make sure you [don't escape passwords](http://stackoverflow.com/q/36628418/1011527) or use any other cleansing mechanism on them before hashing. Doing so *changes* the password and causes unnecessary additional coding. – Jay Blanchard Jul 12 '16 at 12:01
  • @JayBlanchard extra question marks doesn't help me answer your question quickly. I some reason do not like browsers asking passwords. I'm just interested in the error not password science – Erdem Ece Jul 12 '16 at 12:45

0 Answers0