Re: [Phplib-users] What is the 'standard phplib install'?

[Richard A. <rh...@ju...>]

At 11:19 PM +0200 9/9/01, Giancarlo Pinerolo wrote:

>I don't agree with Richard when he says that Phplib is a tool for
>programmers, and though it shouldn't be a problem for them to twickle
>with classnames and extensions.

Since there has been no discussion of my philosophy of PHPLIB on the
phplib-users list, here is some background to Giancarlo's statement.


I believe it is the power and flexibility of PHPLIB which separates
it from the crowd of sess/auth management tools. I have investigated
several packages that have been presented as "simple" alternatives
to PHPLIB and found them to be lacking in areas such as:

* support for non-cookie mode
* strength of the underlying security model
* management of user data
* support for multiple access levels
* and one had a non-commercial use license!!

While these packages may offer a simple "just add one line" alternative
to PHPLIB, they certainly don't have the power or extensibility of this
library.


I also believe that it is essential for the users of PHPLIB to have a
thorough understanding of how it works. PHPLIB by its very nature is
being used to manage secure access to web sites and to protect users'
personal data.

The developers of such sites must understand how the auth/perm scheme
works and how users are authenticated. Failure to have a reasonable
understanding of how it all fits together opens up a risk of breaking
the underlying security model.

To this end, I see the current (manual) process of configuring
local.inc as a gentle introduction to the world of PHPLIB.

And let's face it, once local.inc is configured, using PHPLIB really
is as simple as adding an include line and a pair of page_open and
page_close calls.


I understand that there are many users who want a very simple-to-use
library with just the basic features. The standard install of PHPLIB
includes a very complex local.inc designed to show off all the
features of PHPLIB. I know this is *much* more complex than the
local.inc I usually finish up with in a live site.

Perhaps the problem here is that the standard local.inc isn't
appropriate any more. Rather than showing off everything PHPLIB can
do, perhaps the standard install should be simpler. It needs to
include at least functionality required to get the phplib/pages demo
up and running along with examples of all the techniques that users
should know in order to use PHPLIB safely and effectively.

Examples of the "optional" components such as template, tree, table,
menu etc should be moved to a separate area.

I don't think the solution is to create an install script that asks
a series of questions and then installs PHPLIB the way *it* thinks
you want to use it.

 ...Richard.