如何使用Codeigniter制作更安全的登录系统？

Question

I want to make more secure login system with codeigniter. I can make simple one with this example.

http://www.codefactorycr.com/login-with-codeigniter-php.html

But problem here is that with the example I can have direct access to "check_database" method from url address. But I want to prevent it. So if user tries to get access to the method he will be redirected to login or welcome page. Please note that I might have more than 10 methods. I don't want to configure them one by one. Do you have any solution?

Answer 1

Using a private function won't work.

If you read the manual you can see you need to write the function with an _ before the function name.

So function check_database() becomes function _check_database()

read here http://ellislab.com/codeigniter/user-guide/general/controllers.html#private

Answer 2

Include just after the method opening:

if (!$this->input->post())
  redirect('somewherelse!');

So if there is nothing as POST request, someone trying to access it directly from URL.

If might have more than 10 methods...

If all methods should just receive POST requests, then put it on __construct(), something like:

function __construct(){
  parent::__construct();

  if (!$this->input->post())
    redirect('somewherelse!');   
}

Alternatively you could make a custom library , which could have a CodeIgniter reference to use database, and there make all the login business, returning just true or false on logged status.

Answer 3

Use Private Functions. These wont be accessible via URL & will be hidden from public access