Custom CMS, Caching and login questions

[strident.silence]

Hi,

 

I'm doing my first serious website and I have some questions regarding best practices. I have some experience programming, but not much web programming / php.

The project consist of a dynamic website managed by a custom CMS. There is no user input required other than the login to the CMS.

 

1. Login

 

I was wondering if my method of managing login is correct. Only 3-4 users will have to login to the CMS. I have an authentification function:

public static function authenticate($username, $password){

try {

$dbh = new PDO("mysql:host=localhost;dbname=myDB", $username, $password);

$dbh = null;

return 1;

}

catch(PDOException $e){

$dbh = null;

return 0;

}

}

 

If the connection does not generate an exception, I return 1 to a "loggedIn" variable(session).

When the user is logged in, I use a generic user to do the queries(opening and closing the connection after each query).

Is this viable?

 

2. Caching

 

I cache all the website. The homepage in 1 file, and individual articles in separate files. If I add a news article for example, it will create a html file (news_2.html). When a user clicks on an article link, I just redirect to a page and include the html file in a <div>.  The website won't be updated very often, so I think this will do the job?

[ignace]

public static function authenticate($username, $password){
         try {
            $dbh = new PDO("mysql:host=localhost;dbname=myDB", $username, $password);
            $dbh = null;
            return 1;
         }
         catch(PDOException $e){
            $dbh = null;
            return 0;
         }
      }

 

You should validate the user against a db table not as a db user.

 

class Users {
  private $_pdo;
  public function __construct(PDO $driver) {
    $this->_pdo = $driver;
  }
  public function authenticate($user, $pass) {
    $sql = 'SELECT * FROM users WHERE username = ? AND password = ?';
    $stmt = $this->_pdo->prepare($sql);
    $stmt->bindValue(0, $user);
    $stmt->bindValue(1, $pass);
    $stmt->execute();
    return $stmt->rowCount() == 1 ? $stmt->fetch() : false;
  }
}

[strident.silence]

Thanks for the reply. I did see that it is the usual way to do it, but I was wondering why. Is it more secure against bruteforce attacks? I know that with a lot of users it's just more logical to use a user table.

[ignace]

It's not the usual way, it's the only way. Visitors/users are something entirely different from DB users. DB users have access to your database, where a visitor/user has not.

[Adam]

When the user is logged in, I use a generic user to do the queries(opening and closing the connection after each query).

 

You shouldn't close your connections in-between queries either. PHP has garbage collection built in, you don't need to manage it yourself. Why would you want to close it if you're going to perform another query anyway? You're just going to slow things down.