EE Insider

Password Protected Content Made Simple

by Erik Reagan

Every so often I come across a project where part of the spec involves a private area of content accessible via a password. ExpressionEngine gives us a number of ways to protect content out of the box.

One of the basic approaches is to restrict content to member groups thus requiring a member account for each person. If your content is not member-specific another approach is to create a generic user account and supply each individual with the username and password with which to log in.

Each approach would work in numerous scenarios. However, today I want to look at how we can utilize weblogs on a very basic level to manage password protected content very easily. Our goal is to result in a process that uses default EE functionality and that the “average client” can manage with little difficulty or confusion.

We will be using a single weblog to manage the password-protected content. The type of content is irrelevant at this point so let’s focus on how we can achieve this. At the end I’ll show you a working example of this technique.

How do we store the password?

Considering that we don’t need a deep level of security we only have a few requirements to meet. The most obvious is that no two entries can have the same password. Since we are working “out of the box” with ExpressionEngine we are limited to how we do this. The approach we will take is to use the URL Title field to store the password. EE never stores two URL Titles with the same string so that makes it a perfect way to store our unique password.

Next, we need a way for the user to submit the password to query the database. We will use the standard weblog entries tag pair to do this inside a template running some simple PHP.

So what does this all look like?

The first thing we will need is a weblog, a custom field group and a template. We will work off of the name Private Content so let’s create the following:

Weblog:

• Name: Private Content
• Short Name: private_content

Custom Field Group:

• Name: Private Content fields
• 1 field called “private_content” set to textarea

Template Group:

• Name: “private”
• Templates: index is all we need with PHP on input and no caching

Now that we have created our puzzle pieces go to your weblog groups and assign the custom field to the weblog. Before we dive into templating let’s just add a few entries, so we have something to work with as we add the code to our template.

Go to Publish > Private Content and create an entry with the title “Private Content One” and the URL Title (which is our password) of “password1”. In our content textarea we can just put something simple like “Did this work?”. Feel free to create a few additional entries if you’d like to test them as well. Now that we have some password protected content in the database, we can look at our template.

Our Template Code

Our template code is actually quite concise. We have enabled PHP in our template and set it to input because we will want to use some PHP to determine what to show our users.

Be sure that caching is turned off. Due to the nature of this approach you could potentially cache the private content and we don’t want that.

Let’s first look at the entire template and then go step-by-step.

Let’s look at this in two pieces: PHP and ExpressionEngine tags. Here’s the PHP without anything else distracting us:

The first thing we have to do with PHP is globalize the EE Input class. This gives us access to some of the code that ExpressionEngine provides us, thus reducing the amount of work we have to do. In this case we will be using a function (GBL()) to retrieve a POST variable.

(Now you may be asking yourself, “why would I use a function if I can just get the variable with $_POST[‘variable’]?” Well I’m glad you asked! The GBL() function in ExpressionEngine does a bit of house cleaning for us and first checks if the variable is set and has a value. If it is not set then the function returns FALSE which is very useful to us.)

Moving on to the next line we begin our conditional statement. We are trying to set the variable $the_password to the POST value of the respective input. If it has not been set yet then it will return FALSE. So in plain English the conditional says “if the password has not been set then show our form, otherwise run our ExpressionEngine weblog entries tag pair.”

ExpressionEngine code

Now let’s look at the EE code being used to retrieve our entry. We have a few things going on here so here’s the weblog entries tag pair isolated.

A quick look will tell you that we are specifying the url_title directly in the entries tag and setting dynamic to off. This is key to returning the correct result. If dynamic is not set to off then anyone can use the URL to access the private content. We also use the no_results conditional to show the user an error message with a link to try again. If a result is returned then that means that the password the user entered was correct and it will display for them.

A note on security

You may have already realized this, but this approach is not for elements or content that you really need to lock down tightly. The url_title field is stored in the database as plain text so anyone with database access can retrieve this data. I’ve found this approach to be nice for “private” blog posts and similar use while not requiring someone to register on your site (thus using the member_group restriction approach mentioned earlier). Perhaps some add-on developer reading this will be inspired to write a custom fieldtype that is for password storing and actually encrypts the data. Only time will tell.

Taking this one step further

With the use of custom fields this approach can provide quite a nice offering to your site. Consider using FF Matrix and LinkLocker to provide private content for downloads via a single password for the entry. Or perhaps you could have a rich-content article that is private and managed with a WYSIWYG add-on like Wygwam or LG TinyMCE. Using a hint of creativity with this could allow for some pretty neat solutions.

You can try out this method by visiting my example implementation: Password Protected Content Demo.