Mike - that can't be all of the code. PHP_AUTH_USER is just a method for transferring a user entered value to a variable. It doesn't actually do anything with the data.
My guess is that you have a page that calls for a PHP_AUTH_USER value to be entered not matter what. So the user enters the value, you validate it, then you ask for the user to enter the value again.
Here is how it should work:
A session is started to track the user individually.
A conditional (if...else) evaluates a variable to see whether or not the user has authenticated. For example, you could have a session variable called $_SESSION['authorized'] , which has a default value of false or simply doesn't exist.
---$SESSION['authorized'] is FALSE---
If $SESSION['authorized'] is false or doesn't exist, the script prompts the users (via PHP_AUTH_USER) to enter a value for username and pwd.
The script determines if the values the user entered are valid.
If the values are valid, $_SESSION['authorized'] is set to 'TRUE' or some other value.
---$SESSION['authorized'] is TRUE----
If the first conditional determines that $SESSION['authorized'] is TRUE (or whatever you decide), the page loads and the user IS NOT prompted to enter a value.
The site I gave you not only has tutorials but also free (and paid) code snippets. There are a bunch for user authentication. Perhaps you should download one and look at the code to see how it works.
