variables

[tolwyn]

Hi,
as propably many other, i am new to php... today :-)

i have a webpage which i want to access with username and password. everything is in php. i found some nice php scripts which can be easily implemented. here is some php authentication and redirect script.

<?php

// sample #1 redirect after success

if ( ( !isset( $PHP_AUTH_USER )) || (!isset($PHP_AUTH_PW))
|| ( $PHP_AUTH_USER != 'user' ) || ( $PHP_AUTH_PW != 'open' ) ) {

header( 'WWW-Authenticate: Basic realm="Private"' );
header( 'HTTP/1.0 401 Unauthorized' );
echo 'Authorization Required.';
exit;

} else {

header( 'Location: [url]http://www.php.net/index.php[/url]' );

}
?>

<?php

My authentication window popup but when i enter username and password, it doesn't let me to login and still popup again. I think i have a problem with php variables. HOW? Can i set up PHP variables for PHP_AUTH_USER and PHP_AUTH_PW? I appreciate any help.
Thanks a lot
PHP Newbie

[MrAlaska]

Your problem is probably with global variables, they are turned off by default on recent versions of PHP for security purposes, which means global variables need to be declared before you use them. The variables you want are contained in the $SERVER array. Try putting these lines before your code and see if it works any better:

$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];

[mwood_2k2]

Oh and just something I noticed, your unauthorised header is wrong, I believe it's 403, not 401 for an unauthorised header.

[mrmufin]

HTTP/1.1 Response Codes (per Apache: The Definitive Reference Ben Laurie and Peter Laurie, O'Reilly, ISBN 1-56592-528-9)

100 - Continue
101 - Switching protocols
200 - OK
201 - Created
202 - Accepted
203 - Non-authoritive information
204 - No content
205 - Reset content
206 - Partial content
300 - Multiple choices
301 - Moved permanently
302 - Moved temporarily
303 - See other
304 - Not modified
305 - Use proxy
400 - Bad request
401 - Unauthorized
402 - Payment required
403 - Forbidden
404 - Not found
405 - Method not allowed
406 - Not acceptable
407 - Proxy authentication required
408 - Request timeout
409 - Conflict
410 - Gone
411 - Length required
412 - Precondition failed
413 - Request entity too large
414 - Requiest-URI too long
415 - Unsupported media type
500 - Internal server error
501 - Not implemented
502 - Bad gateway
503 - Service unavailable
504 - Gateway timeout
505 - HTTP version not supported

Or, if you prefer some incredibly dry reading, you can check out the HTTP RFC:
http://www.w3.org/Protocols/rfc2616/rfc2616.html

[el_kab0ng]

I typically database drive my authentication:

<?
$auth = false; 
if (isset( $PHP_AUTH_USER ) && isset($PHP_AUTH_PW)) { 
    mysql_connect( 'localhost', 'user', 'pass' ) 
        or die ( 'Unable to connect to server.' ); 
    mysql_select_db( 'authentication' ) 
        or die ( 'Unable to select database.' ); 
    $sql = "SELECT * FROM users WHERE user = '$PHP_AUTH_USER' AND password = '$PHP_AUTH_PW'";

$result = mysql_query( $sql ) 
    or die ( 'Unable to execute query.' ); 
$num = mysql_numrows( $result ); 
if ( $num != 0 ) { 
    $auth = true; 
} 
} 
if ( ! $auth ) { 

header('WWW-Authenticate: Basic realm="Authorized Access Area"');
header('HTTP/1.0 401 Unauthorized');
echo 'You need Authorization to view this area!<p>Please contact the Admin for access requests.';
exit;

mysql_free_result($result);
mysql_close($connection);
}
?>

[MrAlaska]

I am having email issues that make it difficult to respond to emails until I get around to resolving them. I FINALLY got around to checking my email, though. One made direct reference to this thread, and since the question was directly related I am putting my response here.

You turn global variables back on in your php ini file, but I do not recommend it because doing so puts a layer of exposure on you that is unecessary. Security issues are mentioned here:
http://www.php.net/manual/en/security.registerglobals.php
A general overview of predifined variables start here:
http://www.php.net/manual/en/language.variables.predefined.php

If the above method I posted does not work, the alternative is to address the server variables with the old notation which is reqired by PHP versions prior to 4.1. You can find the documentation here:
http://www.php.net/manual/en/reserved.variables.php#reserved.variables.server

Basically, substitute $HTTP_SERVER_VARS instead of $_SERVER and the code should work on systems prior to 4.1 and is still supported on later versions.

$PHP_AUTH_USER=$HTTP_SERVER_VARS['PHP_AUTH_USER'];
$PHP_AUTH_PW=$HTTP_SERVER_VARS['PHP_AUTH_PW'];

HTTP authentication is covered in the manual also:
http://www.php.net/manual/en/features.http-auth.php