Restriction access to php page doesn't work even the code looks fine. Any help

RomeoX

Hi everybody here, hope everyone is fine

Actually I have a small question related to Restriction Access to specific page in PHP and doesn't work with me.

This code is check from a TXT file that is the user & password match and available in the txt file or not. Actually this code doesn't want to work properly with me. Always doesn't allow me to access the page even I'm entering exact username & password but it says Authorization Required. I'm testing this code on my pc using Wamp application. Could anyone figure where is the problem so when I enter the username with valid password will allow me to access the page.

Here is my code.

<?php 
    if (!isset($PHP_AUTH_USER)) { 
      header('WWW-Authenticate: Basic realm="Restricted access"'); 
      header('HTTP/1.0 401 Unauthorized'); 
      echo 'Authorization Required.'; 
      exit; 
   } 

   $fich = file("passwords.txt");
   $i=0; $validado=false; 
   while ($fich[$i] && !$validado) { 
      $campo = explode("|",$fich[$i]); 
      if (($PHP_AUTH_USER==$campo[0]) && ($PHP_AUTH_PW==chop($campo[1]))) $validado=true; 
      $i++; 
   } 

   if (!$validado) { 
      header('WWW-Authenticate: Basic realm="Restricted access"'); 
      header('HTTP/1.0 401 Unauthorized'); 
      echo 'Authorization Required.'; 
      exit; 
   } 
?> 
<!-- PHP Tutorial --> 
<html> 
<head> 
   <title>PHP Example</title> 
</head> 
<body> 
You have gained access to the <B>restricted area</B> with the user <?php echo $PHP_AUTH_USER?>.


</body> 
</html>

Here is the passwords.txt looks like and saved this file in "C:\wamp\www" folder.

William|1234
Valentino|1444
Mywatch|2222

halojoy

Have you tested with
error_reporting(E_ALL);
Just to see if you can catch any erors/notices info from PHP.
Not showing all errors information when working with php scripts
is Totally CRAAAAAZZZYYYY & STUUUPID :eek:
Then after when you have a working script,
you can/should remove debugging scripting support..

Hopefully you already have error_reporting ON.
In such case, I am sorry for reminding you 🙂

Try this, if you have disabled PHP Errors

<?php
error_reporting(E_ALL);// debug
ini_set('display_errors', true);// debug

if (!isset($PHP_AUTH_USER)) {
  header('WWW-Authenticate: Basic realm="Restricted access"');
  header('HTTP/1.0 401 Unauthorized');
  echo 'Authorization Required.';
  exit;
   }

   $fich = file("passwords.txt"); 

//...
//...
//...

You can put in this test.
Just to see that the explode works alright.

$fich = file("passwords.txt");
   $i=0; $validado=false;
   while ($fich[$i] && !$validado) {
      $campo = explode("|",$fich[$i]);
echo '<pre>'; echo $i; print_r($campo); echo '<br />';// TEST of $campo values
      if (($PHP_AUTH_USER==$campo[0]) && ($PHP_AUTH_PW==chop($campo[1]))) $validado=true;
      $i++;
   }

RomeoX

Thanks for replying and for reminding me to use the debug code. Usually I use it but I forgot this time😃 so sorry for this.

I tried the first part that you told me and it doesn't show any error and I suspect in something that even if there is an error it won't show up because of the screen "look to my attachment".

when I test the second part alone that you told me it seems to me okay even I got this notification

Notice: Undefined variable: PHP_AUTH_USER in C:\wamp\www\validate.php on line 16

Notice: Undefined variable: PHP_AUTH_USER in C:\wamp\www\validate.php on line 16

Notice: Undefined variable: PHP_AUTH_USER in C:\wamp\www\validate.php on line 16

Notice: Undefined variable: PHP_AUTH_USER in C:\wamp\www\validate.php on line 16

Notice: Undefined variable: PHP_AUTH_USER in C:\wamp\www\validate.php on line 16

Notice: Undefined offset: 5 in C:\wamp\www\validate.php on line 14
Your have gained access to the restricted area with the user 
Notice: Undefined variable: PHP_AUTH_USER in C:\wamp\www\validate.php on line 33

I think these notices come up because of the variable is not there PHP_AUTH_USER not defined because I omitted the first part. Could you please check my code in your pc and see if the code is really working or not because you might get something and inform me please if the code is working because might the code will work with you and with me is not working.

bradgrafelman

Seeing as how I don't see $PHP_AUTH_USER defined anywhere, I suspect it never is.

Perhaps you meant $_SERVER['PHP_AUTH_USER'] instead?

RomeoX

no I don't think so. Actually I found this tutorial on one of the website on the internet. I don't know the policy here to put the website where I took this code from or not.

tommyrulez

Romeo, if this is all you have from that site you may want to check this link:

http://php.net/manual/en/features.http-auth.php

It goes into a lot more detail of what you are trying to accomplish with this script.

If you want just a basic login. Go with .htaccess and .htpasswd.

tommyrulez

Sorry,I forgot to add this.

http://httpd.apache.org/docs/1.3/howto/auth.html

bradgrafelman

RomeoX;10943596 wrote:
no I don't think so. Actually I found this tutorial on one of the website on the internet. I don't know the policy here to put the website where I took this code from or not.

It was actually a rhetorical question; you do need to use $_SERVER['PHP_AUTH_USER']. Just because it's on the internet doesn't mean it's true. 😉

The tutorial you found is very outdated as it relies on register_globals being enabled. As such, I'd recommend you ditch the tutorial and find a decent one instead. In the mean time, try using the $_SERVER superglobal array instead: [man]reserved.variables.server[/man].

RomeoX

Thank you all my friends for replying to me. I will take your advice all. And one more thing I'm very happy to see you here in my thread. May god bless you all.