Member Avatar for janicemurby

hi im not sure if come into the right section but im looking at adding a chatroom to my site for my users to use and im wanting it where they dont have to log in or register to chatroom instead they login on site and the username is same as username in site

i know theres a lot that you can intergrate into most cms but my site isnt based on cms
what chat script would you recommend for this
ty in advance kevin

  • 4 Contributors
  • 3 Replies
  • 219 Views
  • 4 Months Discussion Span
  • Latest Post Latest Post by mblan180131

Dani AI

Generated

For a non‑CMS site where the site's login should be reused for chat (the scenario described by ), the two practical routes are: a hosted widget for fast deployment (as suggested) or a self‑hosted/chat‑backend for full control and secure user binding. Hosted widgets are quick but often accept client‑supplied display names unless the provider supports server‑side auth; self‑hosting avoids that weakness at the cost of more maintenance.

Secure username mapping (summary):

  • Never trust a username sent from the browser. Establish chat identity on the server side by verifying the existing session or issuing a short‑lived signed token (JWT or HMAC) when the site login is valid. The chat server must verify that token before accepting a username or creating a session.
  • Persist messages by user_id (foreign key) and store the display name only as a presentation field; don’t rely on client text for identity or permissions.
  • Start with a short prototype that reads the server session, proves the mapping works, then introduce tokens if the chat server is a separate service.

Sanitization and hardening (important given 's SSI warning):

  • Treat all chat input as plain text. Escape on output; do not allow server‑side includes, templating tags, or raw HTML to be executed when messages are rendered.
  • Use parameterized queries for DB writes, limit message length, add rate limits, and enforce HTTPS and sameSite cookies for session protection.
  • Example of safe output encoding in PHP:
    echo htmlspecialchars($message, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');

Implementation notes:

  • For a low‑traffic prototype, a PHP+MySQL table plus AJAX polling works. For real‑time scaling, use WebSockets (Node/socket.io, or a PHP WebSocket library) or an authenticated realtime provider (Pusher/Ably) and implement the same server‑side auth flow.
  • For and others stuck getting “it to work like this site,” verify first that the server can read the site session and issue a server‑verified token before wiring the realtime layer. Prioritize server verification and escaping from the start.

Recommended Answers

All 3 Replies

Member Avatar for Member #120589

Maybe something like this... https://www.tawk.to/

Member Avatar for Carsten_1

I've been having the same type of problem. But only I can't get my website to work kind of like this site.

commented: Did it again? Dredged up an old discussion. You have open discussions. Use them. -2
Member Avatar for mblan180131

I can tell you one thing... have it parse the text entered to prevent people from doing an <!--exec cmd="ls"--> because that can cause problems (it's a Server-Side Include; this command shows the directory of the site which can give hackers info into your site)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.