Details

Download

Demo

Please go through the project page for more details!

The Readme.txt file inside folder "readme" contains instructions for installation and usage

Leave your comments/questions/suggestions on the project page.

Out.

After weeks of fighting with myself, I finally got down to work on something that has been on my mind for sometime now. Yes, it is yet another user authentication/management system in PHP. There are already some great ones out there, and some not so good ones. I wanted a system that was secure, flexible, and easy to work with. What took me an entire week of effort is presented below. Without further delay, presenting phpUserAuth

Features

• Secure with support for sessions based and/or cookie based authentication
• Tons of configuration option for those who know what they are doing. For others, its easy as a cake!
• Passwords are *always* hashed before they are sent over the network, with fallback to plain text if JavaScript is not supported in the browser
• Only salted, hashed passwords are saved in the database. Even if the DB is stolen, it is almost impossible to get the original password
• Support for multiple simultaneous sessions or a single active session
• Administrator can choose how users are activated after they signup. It can be automatic activation, manual activation by the admin, or an activation mail can be sent to the user
• Password is NEVER sent over the email. If the user forgets his password, he can request a password reset mail.
• User defined access control levels
• Flexible. If the administrator wants to add another field, simply updated the configuration file, and put the field in the signup form! The rest is taken care of by the script!
• Prevention from XSS attacks - all data sent to the server is cleaned using the excellent InputFilter class
• Support for template based HTML email notifications with changeable templates
• Emailing done through the excellent PHPMailer with support for SMTP+SSL
• Custom redirection after login/logout
• Pre-designed forms
• Snap in install - Simply drop the folder into your existing application, configure a few site options and database settings, and you are done!

Requirements

• PHP 5+ as the core classes are OO
• MySQLi support
• MySQL 5+ database server

Is that too much to ask? That being said, if you run a fairly recent server, all these should be there by default. For testing, you can check out XAMPP which is available for Windows, Mac and Linux!

License
I'm planning to release it under some open source license. If that doesn't work out, it will still be FREE

Download
It is not completely done yet. The admin area needs some work. So it will be released, when its done

Notes
1) As always, it isn't perfect! If you find any bugs, errors, or know a way where things can be done better, please leave a comment!
2) The application hasn't been profiled yet. There WILL be places where I might have complicated things. Will be taken care of after its been released

Anyone looking for a complete PHP framework will have definitely stumbled across these four major options

• Zend - The original PHP framework that started it all (Apparently CakePHP came earlier than Zend)
• Cake PHP - Easy and light with support for both PHP 4.1+ and PHP 5+
• Codeigniter - Relatively new lightweight framework
• Symfony - Rails inspired, comprehensive

Although there are many more frameworks out there in the wild, these are the most popular and actively developed. As you guessed, this post is about Symfony and why I think its the best. Calling something "the best" is sure to draw a lot of fire from all quarters, so I'll omit it hereon

The Good:

• Feature Rich - Has all the features one expects from a RAD framework - MVC design pattern, ORM tools, scaffolding, caching, authentication, internalization and localization
• Actively Developed - The team not only works on the framework, it also incorporates suggestions/enhancements from community members
• Extensive Plugin Repository - It has 647 plugins from 283 contributors
• Amazing Documentation - I can't stress on this enough. Documentation makes ALL the difference when you are spoilt for choice. In addition to the complete API reference, you have "The Book" which is a complete reference to learn Symfony step by step. Then there are the real world examples - Jobeet.com tutorial which guides you in making a Complete working website in 24 days (1 hour a day). And yes, you can check out the site here
  Then, you have the customary "Create a blog in 1 hour" tutorial, and another one that makes the admin interface
• Flexible - There are always two ways to do something using Symfony. For ORM, you have doctrine and propel. For javascript you can use prototype(inbuilt), jQuery or Mootools. Supports XCache, eAccelerator, APC , Memcached for caching.
• Automatic Admin Generation - Borrowed from Rails, this module makes it a breeze to generate a optimized and fully functional CRUD interface for your applications. And yes, it does work perfectly well
• Extensive developer tools - Symfony supports three deployment environments, along with very good developer tools that lets you configure, debug and monitor your application performance from the web page itself.
• Integrated Testing Framework - The "Lime" toolkit allows for unit and functional tests to be written and executed with minimal fuss
• Rails Inspired - Need I say more?

The Not So Good:

• It is NOT a small and light framework. But I don't think you can consider 20 MB too large these days, comparing with RoR
• Learning Curve - Don't use it if you want to finish your application yesterday. It takes time to learn how to use it, due to its strict adherence to coding standards and quality. If you are an experience programmer though, you will find it easier
• Needs optimization - Even though it isn't a pain to optimize unlike RoR, it still needs some work like setting up caching, and using Memcached for database objects if you want to deploy a real world application on it. But then good documentation is available for that too
• Its NOT for everyone - This is general to all frameworks. No framework, RoR included, is a "one-size-fits-all" deal. So before you decide to take the plunge, design your application, and put considerable time into thinking if you really need a framework. If all you need is a standard blogging engine, or a normal website with a couple of dynamic scripts, ANY framework in ANY language will be an overkill.

If you can live with the above three points, then Symfony is for you. Even though I'm a complete beginner, I've started to love Symfony. I'm sure you will too, if you look at it objectively. So install it, learn it and have fun!

Edit: Found another great post - http://www.mellowmorning.com/2007/08/18/ten-reasons-why-symfony-rocks-part-1/

The demo is here. If anyone is interested in the code, drop a comment.

P.S: Yea I suck at CSS. If anyone does a better job, please let me know.

Also, PHP's lack of support for threaded programming is another major let down. While this is a genuine issue, rewriting the entire PHP core and the parser to support threads is not worth the effort. But I genuinely haven't felt the need for multi-threading in PHP till date. While threading is a must for system programming, the need for it in a web environment is not entirely clear. Also, the major strength of PHP - its simplicity will be compromised if threading is to be introduced.

Another genuine concern is the confusion caused by settings such as "register_globals" , "magic_quotes", "safe_mode" . These three variables have had a major impact on the deployment of PHP scripts. Web hosts allow ways to tweak these settings, but for the layman who just wants to get a blog up and running, its a bit of a hassle. Also its an issue that needs to be addressed by web developers who want maximum compatibility for their applications. The next major release PHP 6.0 aims to completely do away with this settings for good, and that will indeed clear up a lot of mess.

Most of these issues boil down to one thing - the lack of a an official formal specification. Although the PHP Group oversees the continued development, it is still a community effort, and as such requires stringent software engineering and management. Since the original PHP parser was completely rewritten for version 3 and above, there have only been attempts to patch up vulnerabilities, and add new features like Object Oriented Programming, namespace support among others. PHP 6 is touted to be THE release, which will address most of the major concerns.

For all its shortcomings, its still THE easiest server side scripting language to work with. The C/C++ syntax, seamless integration with MYSQL, support by almost all web hosting providers still make it THE web language IMHO. The LAMP stack is undoubtedly the king of the web, and will continue to be so, owing to the simplicity and widespread community support offered by all its components. And not to forget, its completely free.