How-to

Just managed to find some time to play around with Yii. Yii is powerful but there is still a long way to go if we are talking about documentation for Yii framework. In Yii framework, we can see that it is very different from CodeIgniter where documentation is really structured and well understood. Nonetheless, i still feel that Yii framework is worth to explore. I managed to get my own customized authentication on Yii by adding some secure feature such as hashing, salt, key and etc. So here i am writing this tutorial to share with you more about Yii framework using MySQL database.

Requirement

Since this is more like a follow up tutorial, there are a few requirements before you start reading this tutorial.

1. Installed Yii with a MySQL database.
2. Setup Gii and get the user CRUD completed.

Customize Authentication - Database

Now here comes the tricky part. We need a database that stored our hashed password which is 128 bits since i am using sha512. Our data schema should looks like this,

CREATE TABLE tbl_user (
    id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
    username VARCHAR(128) NOT NULL,
    password VARCHAR(128) NOT NULL,
    email VARCHAR(128) NOT NULL
);

Well, it looks the same as the demo one so just ignore me lol. Create this table and we are ready to do some MVC. If you are following the tutorial you would most likely get a CRUD user setup. But we only have 'admin' and 'demo' login account. We would definitely want something better.

Customize Authentication - Model

In order to validate a user, we need to create a few methods in the model folder in order to authenticate and store user password. We will need to create these functions on our User.php file on our model folder.

	/**
	 * @return boolean validate user
	 */
	public function validatePassword($password, $username){
		return $this->hashPassword($password, $username) === $this->password;
	}
	/**
	 * @return hashed value
	 */
	DEFINE('SALT_LENGTH', 10);
	public function hashPassword($phrase, $salt = null){
		$key = 'Gf;B&yXL|beJUf-K*PPiU{wf|@9K9j5?d+YW}?VAZOS%e2c -:11ii<}ZM?PO!96';
		if($salt == '')
			$salt = substr(hash('sha512', $key), 0, SALT_LENGTH);
		else
			$salt = substr($salt, 0, SALT_LENGTH);
		return hash('sha512', $salt . $key . $phrase);
	}

the two methods above is used to validate the user password during login and the other method returns a hashed password given the original plain password value. Once these two methods are pasted into the user.php file. We are done with our modal!

Customize Authentication - Controller

In controller, we need to modify the create and update handler but i will just demonstrate the create user handler. Go to your controller folder and look for UserController.php. Change the method actionCreate to the following

	/**
	 * Creates a new model.
	 * If creation is successful, the browser will be redirected to the 'view' page.
	 */
	public function actionCreate()
	{
		$model=new User;

		// Uncomment the following line if AJAX validation is needed
		// $this->performAjaxValidation($model);

		if(isset($_POST['User']))
		{
			$model->attributes=$_POST['User'];
			$model->password = $model->hashPassword($_POST['User']['password'], $_POST['User']['email']);
			if($model->save())
				$this->redirect(array('view','id'=>$model->ID));
			else
				$model->password = $_POST['User']['password'];
		}

		$this->render('create',array(
			'model'=>$model,
		));
	}

This way, we can create user with hashed password instead of plain password stored in our database.

Customize Authentication - Component

Next we need to authenticate our users. The original one just defined 'demo' and 'admin' as the only users that we are able to login. But now we have a database and a list of user and password. We should really secure our login. Here we modify our original authentication method to the following one.

	public function authenticate()
	{
		$username = $this->username;
		$user = User::model()->find('username=?', array($username));
		if($user === NULL)
			$this->errorCode=self::ERROR_USERNAME_INVALID;
		else if(!$user->validatePassword($this->password, $this->username))
			$this->errorCode=self::ERROR_PASSWORD_INVALID;
		else{
			$this->username = $user->username;
			$this->errorCode=self::ERROR_NONE;

		}
		return !$this->errorCode;
	}

this allowed us to go through the users in our database table instead of the hardcoded one by using the method we wrote previously on the modal folder.

Now, our user will be authenticate using our customized authentication process rather than using the default one!

I decides to move to Yii finally after comparing between different framework. At this point, although Yii documentation wasn't as good as CI, it is not something that will restrict me from entering Yii framework. Like most people i started with the tutorial given on Yii website. Here is something i tried out today through the instruction given on the cookbook section. In this article, i will extend what is present in the article in a more visual form.

Requirement

Here are some of the basic requirement for this tutorial.

1. Window XP (Vista and Win 7 will also work)
2. Yii Framework 1.1.3
3. WAMP 2.0i (Apache 2.2.11, PHP 5.3.0, MySQL 5.1.36, Phpmyadmin)
4. Basic installation of WAMP (C:\\wamp\...)

Setting up yiic on WAMP

Firstly install your WAMP with the default installation.

Once you have installed this, you should be ready to setup your computer local environment to use Yiic from Yii framework. Firstly, go to your environment variables located at Control Panel->System->Advance->Environment Variables->Path as shown below,

Once you reached the path textbox, entered the following location to tell your windows that they are the environment variables.

1. C:\wamp\www\yii\framework
2. C:\wamp\bin\php\php5.3.0

In this case, we are telling our window where is our yii framework yiic.bat and where is our php.exe as shown below,

since my WAMP is using php5.3.0, the folder shows the current version my WAMP is using. This might differ. Hence, change the directory path according to the php version you use. On the other hand, my yiic.bat is located at C:\wamp\www\yii\framework as shown below, hence, i pass this to the environment variable instead.

Click 'OK' for all the settings you have made and restart you PC. Once your windows has rebooted, click start->run.. and type 'cmd'. On the screen type "yiic webapp C:\\wamp\www\mywebsite" andtype 'yes". The folder should show up on your localhost.

Now you need to change your setting from sqllite3 to MySQL. This is located at C:\wamp\www\mywebsite\protected\config\main.php, open this file and replace the codes with the following.

<?php

// uncomment the following to define a path alias
// Yii::setPathOfAlias('local','path/to/local-folder');

// This is the main Web application configuration. Any writable
// CWebApplication properties can be configured here.
return array(
	'basePath'=>dirname(__FILE__).DIRECTORY_SEPARATOR.'..',
	'name'=>'My Web Application',

	// preloading 'log' component
	'preload'=>array('log'),

	// autoloading model and component classes
	'import'=>array(
		'application.models.*',
		'application.components.*',
	),

	// application components
	'components'=>array(
		'user'=>array(
			// enable cookie-based authentication
			'allowAutoLogin'=>true,
		),
		// uncomment the following to enable URLs in path-format
		/*
		'urlManager'=>array(
			'urlFormat'=>'path',
			'rules'=>array(
				'<controller:\w+>/<id:\d+>'=>'<controller>/view',
				'<controller:\w+>/<action:\w+>/<id:\d+>'=>'<controller>/<action>',
				'<controller:\w+>/<action:\w+>'=>'<controller>/<action>',
			),
		),
		*/
		'db'=>array(
			'connectionString' => 'mysql',
		),
		// uncomment the following to use a MySQL database

		'db'=>array(
			'connectionString' => 'mysql:host=localhost;dbname=yourdatabasename',
			'emulatePrepare' => true,
			'username' => 'root',
			'password' => '',
			'charset' => 'utf8',
		),

		'errorHandler'=>array(
			// use 'site/error' action to display errors
            'errorAction'=>'site/error',
        ),
		'log'=>array(
			'class'=>'CLogRouter',
			'routes'=>array(
				array(
					'class'=>'CFileLogRoute',
					'levels'=>'error, warning',
				),
				// uncomment the following to show log messages on web pages
				/*
				array(
					'class'=>'CWebLogRoute',
				),
				*/
			),
		),
	),

	// application-level parameters that can be accessed
	// using Yii::app()->params['paramName']
	'params'=>array(
		// this is used in contact page
		'adminEmail'=>'[email protected]',
	),
);

Change 'yourdatabasename' in the text above to your database name and you'r done!