This is my first time and I'm very very new to PHP. I have just started to create a website where I want to password protect access to some Excel documents but don't want to use the MS Excel password facility in the spreadsheet. I've seen loads of scripts, which either need server side componants or look very complex when all I need is a simple confirm user and password facility.
If you are going to write this yourself, there are two approaches:
First, if you want each doc to have a password for it, rather than a user login/permissions setup, have a database with all of the doc info and password required...then write an index page that queries the db and lists the documents from there (do not query the file list), and then a form to enter a password once one is selected. This will submit to a page that checks the password entered vs. the one stored in the database based on which document was selected, and if it matches, allows the download.
Second, if you pursue a user/password system, you'll need to set up a table for users, registration page, and then use sessions or cookies to handle logon/logoff and access priviledges. You will also need a separate table for permissions, with rows matching a user ID to a doc ID.
It is good to note, one safe method of file download is to have the script copy the file from a locked-down directory to a temp directory using a random string (sometimes based on session_id) as the filename, then deleting it after the user has downloaded it.
Another method is to store the file info as binary data in a database, rather than as a flat file. Then the script would write the file before the download, then delete it later as in the previous option.
There are other methods around that will prevent a user who knows the filename from just typing the path to access it...these two are both common and well practiced.
Database design and performance optimization, custom PHP scripts, and publicly available resources for developers! http://www.zeropride.com