Personally, I don't mess around with re-direction to auth pages. Instead, I create an authorization function that does the heavy work and then require() it on any pages that need to be authorized.
+++++++++++++++++++++++++++++++
EXAMPLE:
<?PHP
require('mod_auth.php');
$authtext = mod_auth();
if ($authtext) {
print $authtext;
}
else {
//
// put all your regular page stuff here
//
}
?>
+++++++++++++++++++++++++++++++
In the above example, the protected page calls a function named mod_auth(). This function does the actual user authorization. The function checks if the page was called from a 'post' operation (ie a form), which button on the form was pressed, and performs the appropriate action.
The first time the page is being requested, the request method is 'get' so the mod_auth() function returns the HTML of a sign on form; $authtext is not blank, and the example above would display the signon form to the user.
When the user enters the signon information and clicks the 'submit' button, the form calls the same page again (PHP_SELF). This time mod_auth() knows what form and submit button was pressed and performs the database authentication.
If the authentication is successful, mod_auth() returns nothing and the example above drops through to display the protected page.
If the authentication fails, mod_auth() returns the text of an error or 'not authorized' page. Again, $authtext is not blank so the error or 'not authorized' page is displayed to the user instead of the protected page.
The mod_auth() function can be enhanced to handle other things like "forgot password" and "sign up" functions as well. Also, such an authorization function must be used with some type of session handling so the user doesn't have to re-enter userid and password for every protected page or refresh.
-- Rich Rijnders
-- Irvine, CA US
