Encryption using https

I have been reading up via Wikipedia and HTML books but ended up very confused.

On the face of it what I want to do is simple.

I intend to have a database on a webite such as robertos.me.uk below, (but not that one), with visitors able to register on the site then log in to update the database.

I therefore need to have a secure method of handling the registration and login.

If I merely put the relevant pages in my hosts httpsdocs folder, does that cause the host's system to handle all the TLS encryption stuff, so I can ignore the problem, or does it just signify to the user that encryption is in force and I have to code it all?

Why do you want it to run through HTTPS? You would only need that when handling secure information such as transactions or or bank details - unless that is what you want to do...
What you want to do can be done with PHP and sessions...

In reference to www.purplecloud.com/faq:

Do you offer SSL?

You can host files using https - simply place the files in the httpsdocs directory instead of the standard httpdocs. However, because we operate a shared hosting platform, the SSL certificate used will not match your domain name. This means that most browsers will display a trust warning to people visiting your secured site, even though the communication is secured.

In reply to a post by BatBoy:

In reference to www.purplecloud.com/faq:

Do you offer SSL?

You can host files using https - simply place the files in the httpsdocs directory instead of the standard httpdocs. However, because we operate a shared hosting platform, the SSL certificate used will not match your domain name. This means that most browsers will display a trust warning to people visiting your secured site, even though the communication is secured.

Yes, I read that a while ago and it just added to my confusion.

I think it says that it is all handled for me, as per my question, but as I don't have my own certificate it would issue the warning - similar to what I get when I go to look at the webstats for robertos.me.uk.

That would be a pain!

In reply to a post by metalhead41:

Why do you want it to run through HTTPS?

Because I haven't a clue about the security measures I need to take. I assumed that was the correct way.

You would only need that when handling secure information such as transactions or or bank details - unless that is what you want to do...
What you want to do can be done with PHP and sessions...

I am using PHP at an introductory/non-expert level. I shall read up Sessions - thanks for the pointer.

All I'm trying to do is make the username and password non-sniffable. The data itself is not likely to be critical, though it would be highly awkward if someone easily picked up the name and password then logged in and altered the data.

As BatBoy says, Purple Cloud seem to handle it, but not in a satisfactory manner without hassle re certificates.

SSL certificates are a rip-off. I used to use self-signed certificates just to make sure data transfer to/from a site was secure and wasn't at all interested in proving the authenticity of the site. Then Microsoft came along with their stupid browser updates and show the site as insecure because the certificate is self signed.

In your situation I'd use the httpsdocs solution and train your users.

Yeah, that's how I read it too.

Don't use a self-signed certificate. Use a proper one.

If it's non-critical data, you definitely don't need to go down the SSL route.

If you get it right with PHP Sessions, your site will be secure. Passwords can be set using an md5 hash so it's encrypted when put into the database. Are you creating logins for people to actually modify a database, or are you looking at a user logs in and gets a user area?

One database with info from many users. Each will be able to update his own data and no-one else's, but I may want them to be able to allow viewing by others. Possibly also allowing viewers to copy from it into their own as well.

At the moment I envisage one set of files with a user ID on the data rows, but might change my mind to ID-identified clones for performance. I don't think that affects this issue - it will be just a case of how I handle things internally.

Basically I'm OK with programming and databases, but C++/SQLServer on LANs before the days of Intranets, not HTML/PHP/MySQL on websites.

At the moment I can manage an unsecured login and update/display a database. I just want to sort this out before going into the main development rather than bolt it on later. Post-fitting security can be hell.

Thanks to all so far .