Tuesday, May 8, 2012

A simple login system with PHP. Does it really need an SSL certificate?

I plan to offer my website designs and if someone is interested in an easy-to-manage blog (or just doesn't want to make new html files for new posts on his/her own) this simple login/blog system is what I will offer them as an addition. It's main purpose is to enable only one user to log in by providing the password (the username cannot be changed) and allow him/her to edit a few account settings (displayed name, avatar, bio) or make new pages/posts by just writing new content into the window. This is supposed to be a very simple system with no registration forms - a framework which I want to provide to all clients who would choose to buy my designs.
Since the login system is so simple, I dare to say that there is little authentication needed - just the password entry (+any other forms where the user enters, for example, the content of a new post). So basically, it should have the following functions: trim(), htmlspecialchars(), mysql_string_escape(), checking for valid characters with a regular expression and a user session (by the way, is a user session even needed on a site with only one user?). What else is needed on such a simple website? I was thinking about a self-signed SSL certificate, however, it causes a security warning. Is it even needed in such a situation?
This system would be reused in every HTML/CSS design project I'd work on, so it needs to be decided now, since I'm going to provide this framework along with the website for those people who just want to run their personal website/blog without learning all that wordpress stuff.
I know websites should be encrypted, but since the only encryption needed here is for the password, what should I use?





No comments:

Post a Comment