that is normal...
you have to check is username and password is Ok, and then DON'T send header...
something like (original example from php documentation):
<?php
if(!isset($PHP_AUTH_USER)) {
header("WWW-Authenticate: Basic realm=\"My Realm\"");
header("HTTP/1.0 401 Unauthorized");
echo "Text to send if user hits Cancel button\n";
exit;
} else {
echo "<p>Hello $PHP_AUTH_USER.</p>";
echo "<p>You entered $PHP_AUTH_PW as your password.</p>";
}
?>
or something like:
if ($PHP_AUTH_USER != "my_user_name" && $PHP_AUTH_PW == "my_password")
{
header("WWW-Authenticate: Basic realm=\"My Realm\"");
header("HTTP/1.0 401 Unauthorized");
echo "sorry, no permitions";
exit; // realy important
}
... your code
IGOR