absolutely.
The .html file calls auth.php to verify if the user has logged in or not, if not it goes to the login.php page, if he has, it verifies it through the $_SESSION variables for username and password compared to the database and lets the user view the page. If the username/password are invalid it goes to the login.php page again to have them re-enter it.
As I said the .html page has this at the top:
<?PHP
session_start();
$_SESSION['page'] = "index.html" //or whatever that page file is
session_write_close();
require 'auth.php';
?>
here's the auth.php page(required by all 'secure' .html pages:
<?PHP
include '../Scripts/functions.php';
session_start();
if (!$_SESSION['user1'] || !$_SESSION['pass1']) {
// What to do if the user hasn't logged in
// We'll just redirect them to the login page.
header('Location: login.php');
exit();
} else {
// If the session variables exist, check to see
// if the user has access.
AccessDB();
$result = mysql_query("SELECT count(UserID) FROM users WHERE Password='$_SESSION[pass1]' AND Username='$_SESSION[user1]'") or die("Couldn't query the user-database. auth");
$num = mysql_result($result, 0);
if (!$num) {
// If the credentials didn't match,
// redirect the user to the login screen.
session_write_close();
header('Location: login.php');
exit();
}
}
?>
Here's the login.php page which is called only from the auth.php page when needed:
<?PHP include '../Scripts/functions.php';
AccessDB();
// Add slashes to the username, and make a md5 checksum of the password.
$_POST['user'] = addslashes($_POST['user']);
$_POST['pass'] = MD5($_POST['pass']);
$result = mysql_query("SELECT count(UserID) FROM users WHERE Password='$_POST[pass]' AND Username='$_POST[user]'") or die("Couldn't query the user-database.");
$num = mysql_result($result, 0);
if (!$num) {
// When the query didn't return anything,
// display the login form.
echo "<title>Login</title><h3>User Login</h3>";
echo "<form action='$_SERVER[PHP_SELF]' method='post'>";
echo "Username: <input type='text' name='user'>
";
echo "Password: <input type='password' name='pass'>
";
echo "<input type='submit' value='Login'>";
echo "<input type=reset name=reset value='Clear'>";
echo "</form>";
} else {
// Start the login session
session_start();
// We've already added slashes and MD5'd the password
$_SESSION['user1'] = $_POST['user'];
$_SESSION['pass1'] = $_POST['pass'];
// All output text below this line will be displayed
// to the users that are authenticated. Since no text
// has been output yet, you could also use redirect
// the user to the next page using the header() function.
// header('Location: auth.php');
if(isset($_SESSION['page'])) {
$go = $_SESSION['page'];
} else {
$go = "index.html";
}
header("Location: $go");
exit();
}