You should never make the admin section public. You can't rely on obscurity for this, authorisation is the way to go. You can do this by using .htacces, as described here, or by relying on PHP. A crude example follows below.
Below is a simple login implementation. If the password is correct it will allow the user to go to admin.php. You should read the PHP manual on sessions though, because the session header should be present on every page behind the login page. The password handling could be handled more secure as well.
<?php
session_name('MyAdminSession');
session_start();
if (isset($_POST['userid']) && isset($_POST['password'])) {
$userid = $_POST['userid'];
$password = md5($_POST['password']);
if ($userid == 'myusername' && $password == md5('mypassword')) {
$_SESSION['logged_in'] = true;
header('location: admin.php');
exit;
}
}
?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>My login page</title>
</head>
<body>
<form action="index.php" method="post">
<label for="userid">Username: </label><br />
<input name="userid" type="text" id="userid" /><br />
<label for="password">Password: </label><br />
<input name="password" type="password" id="password" /><br />
<p><input type="submit" name="submit" class="button" value="Log In" /></p>
</form>
</body>
</html>
与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
