If you want to implement password protection on a per-script basis, you can create a basic authentication mechanism by combining the header () function with the $php_auth_user, $PHP _AUTH_PW global variable. Typically, the server-based authentication request/Response process is as follows:
1. The user requests a file from a Web server. If the file is within a protected area, the server responds by adding a 401 (illegal user) string to the header of the response data.
2. The browser pops up the username/password dialog box after seeing the response.
3. The user enters the user name and password in the dialog box, and then clicks OK to send the information back to the server for authentication.
4. If the username and password are valid, the protected file will be displayed to the user. This confirmation will continue to be effective in the time that the certified user is in the protected area.
A simple PHP script can simulate an HTTP authentication request/Response system by sending the appropriate HTTP headers to automatically display the Username/Password dialog box on the client screen. PHP stores the information in the User Input dialog box in the $php_auth_user and $PHP_AUTH_PW variables. By using these variables, you can store lists that do not conform to a username/password test to a text file, a database, or anywhere you want.
Note: $PHP _auth_user, $PHP _AUTH_PW, and $php_auth_type global variables are valid only if PHP is installed as a module. If you are using the CGI version of PHP, you will only be limited to using htaccess authentication or database based authentication, and the HTML form allows users to enter user names and passwords, and then allow PHP to complete validity checks.
This example shows a confirmation check for two hardware encoded values, which is theoretically identical, regardless of where the username and password are stored.
?
/* Check variable $PHP _auth_user and $PHP_AUTH_PW value * *
if ((!isset ($PHP _auth_user)) | | (!isset ($PHP _AUTH_PW)) {
/* Null value: Send the data to produce the display text box head * *
Header (' Www-authenticate:basic realm= ' my Private Stuff ');
Header (' http/1.0 401 Unauthorized ');
Echo ' Authorization Required. '
Exit
else if ((Isset ($PHP _auth_user)) && (Isset ($PHP _auth_pw)) {
/* Variable value exists, check it is correct/
if (($PHP _auth_user!= "Validname") | | ($PHP _auth_pw!= "Goodpassword")) {
/* Username input error or password input error, send the data to produce display text box head * *
Header (' Www-authenticate:basic realm= ' my Private Stuff ');
Header (' http/1.0 401 Unauthorized ');
Echo ' Authorization Required. '
Exit
else if (($PHP _auth_user = = "Validname") | | ($PHP _AUTH_PW = = "Goodpassword")) {
/* username and password are correct, output success information * *
echo "<p>you ' re authorized!</p>";
}
}
?>
It must be reminded that this approach does not provide a full range of security for the directory when you are using file-based protection. This is obvious to most people, but if your brain establishes a connection between the pop-up dialog box and the protection of a given directory, you should consider this further.
Julie Meloni is the technical director of I2i Interactive and a strong advocate for Linux and the open source community. She wrote a lot of books about PHP and other technologies, and became an expert on CNET Builder.com's long-term contribution.
