J2Ee Hosting, Sun Java Developing, Domain Name Hosting Blog

808Part VCase StudiesAdding an HTML Editing ToolThis simple Weblog is quite adequate for many purposes, but it has one big disadvantage: You can t write up your daily entries using the Web itself. Instead, you must create each entryusing a text editor like emacsor Notepad and save it to your Web server s docroot. This canbe a significant issue over time, especially if you are not allowed telnet/ssh/FTP access toyour server or aren t comfortable with the process. HTTP is the next logical step for manyusers, and is probably no less unsafe than using FTP. This process has one big problem: You need to give read/write permissions to the HTTP user(usually Nobody) in a particular directory. This is an inherently insecure process, and we donot recommend it in the long run. We ll describe the HTTP tools here so that you can becomecomfortable with the new aspects before moving on to a better solution, which is using adatabase instead of separate include()files for each entry. We ll also try to keep the secu- rity problems to a minimum, employing a password and letting you send mail to yourself if an unauthorized person tries to log in. The files you need for an HTML-based file-writing tool are: .login.php .logentry.php .logentry_handler.php .password.incPut password.incin a directory outside the Web tree, such as /home/htmluser. This willensure that your passwords cannot be read via the Web without being processed by PHPfirst. The directory must be world-executable and the document must be readable by thehttpduser (Nobody). If you have root access on this server, you could chownit to belong tothe httpduser; if not, you may have to make the file world-readable, which is a securitybreach. Be sure to use a password different from your system user password, just in case it s compromised. Listings 43-8 through 43-10 are the files you need for an HTML form to edit Weblog entries. Listing 43-8:Weblog entry login screen (login.php)

Supply a username and password.