Re-attemp logins

jeffwhite

I want give my users 3 chances to login.
Here's my code
<?php
if(!isset($PHP_AUTH_USER))
{
header("WWW-Authenticate: Basic realm=\"My Realm\"");
header("HTTP/1.0 401 Unauthorized");
echo "Text to send if user hits Cancel button\n";
exit;
}
else
{
//db connect statement here
//select a database statement here
//$QUERY="SELECT * from accounts where login = ".$PHP_AUTH_USER." AND password= ".$PHP_AUTH_PW;
//$RecordSet=mysql_query($QUERY);
//if(mysql_num_rows($RecordSet)=1)
if($PHP_AUTH_USER!="testl" || $PHP_AUTH_PW!="testp")
{
$attempts++;
if($attempts>=3)
{
echo "you are unwelcome here";
echo " ";
echo $PHP_AUTH_USER;
}
else
{
echo "try again ";
echo "ok, but how? ";
echo "Good Question.";
}
}
else
{
echo "Welcome into my site All the other code goes here";
}
}
?>

It seems like once PHP_AUTH_USER gets set you have to close the browser to unset it. I want a way around that. I hate sending headers.
It may be something easy but I'm wiped out right now.

I submit this request to the php masters if the hope they will guide me to the truth. amen.

jeff

RoadKingHD

Hi Jeff,

I do things a bit differently and do not auth. users this way but I do know that (PHP 4.1.0) $_SERVER["PHP_AUTH_USER"] is where the auth user is stored. Stored in HTTP_SERVER_VARS in older PHP. Read more [MAN]PHP_AUTH_USER[/MAN] details.

So to reset, why not assign NULL to them?

$_SERVER["PHP_AUTH_USER"] = NULL;

am I off base here??

Just a thought...

Kevin

jeffwhite

OK, I figured it out I think
Instead of !isset(PHP_AUTH_USER)
I go staight to evaluating what they entered which first time through is nothing.
I use if($PHP_AUTH_USER!="login" || $PHP_AUTH_PW!="password")

Turns out HTTP authentication already gives you 3 chances.

Here's the complete code.

//you can pput a database query here.
if($PHP_AUTH_USER!="testl" || $PHP_AUTH_PW!="testp")
{
unset($PHP_AUTH_USER);
header("WWW-Authenticate: Basic realm=\"WWN\"");
header("HTTP/1.0 401 Unauthorized");
?>
<HTML><HEAD><TITLE>WWN Article Database Access Denied</TITLE></HEAD>
<BODY>
For access to the site contact our webmaster 
<a href="mailto:webmaster@mydomain.com?subject=request for database access">Request Access</a> 
</BODY>
<HTML>
<?
exit;
}
else
{
echo "Welcome to my site All the other code goes here";
}

jeff