Header函數和PHP_AUTH_USER做使用者驗證

php Header PHP_AUTH_USER PHP_AUTH_PW 使用者驗證

在php中，可以使用Header函數做一些有趣的事情，使用者驗證就是其中一個很有意思的功能。具體用法：

Header("WWW-Authenticate: Basic realm="USER LOGIN"");

Header("HTTP/1.0 401 Unauthorized");

在頁首設計這兩個Header函數，頁面在載入前會出現一個登入框，要求輸入使用者名稱和密碼。習慣了在頁面登入的我們，是否覺得這樣的登入很原始，又很新奇呢？

為了擷取從這個對話方塊中傳來的使用者名稱和密碼，需要用到php提供的兩個特殊變數$PHP_AUTH_USER和$PHP_AUTH_PW，要這樣使用這兩個特殊變數好像需要在php.ini中設定相關的選項，不然就只能像下面這樣引用：

$_SERVER['PHP_AUTH_USER']

$_SERVER['PHP_AUTH_PW']

擷取到使用者提交上來的使用者名稱和密碼之後，要怎樣處理邏輯就跟我們一般的程式處理沒有什麼區別了。下面提供兩個常式供參考：

if(!isset($PHP_AUTH_USER)) {

Header("WWW-authenticate: basic realm="XXX"");

Header("HTTP/1.0 401 Unauthorized");

$title="Login Instructions";

?>

In order to enter this section of the web site, you must be an XXX

subscriber. If you are a subscriber and you are having trouble logging

in,

please contact support@xxx.com.

exit;

} else {

mysql_pconnect("localhost","nobody","") or die("Unable to connect to

SQL server");

mysql_select_db("xxx") or die("Unable to select database");

$user_id=strtolower($PHP_AUTH_USER);

$password=$PHP_AUTH_PW;

$query = mysql_query("select * from users where user_id='$user_id' and

password='$password'");

if(!mysql_num_rows($query)) {

Header("WWW-authenticate: basic realm="XXX"");

Header("HTTP/1.0 401 Unauthorized");

$title="Login Instructions";

?>

In order to enter this section of the web site, you must be an XXX

subscriber. If you are a subscriber and you are having trouble

logging in,

please contact support@xxx.com.

exit;

}

$name=mysql_result($query,0,"name");

$email=mysql_result($query,0,"email");

mysql_free_result($query);

}

?>

來源頁面：http://www.weberdev.com/get_example-82.html

另外一個參考的常式：

//assume user is not authenticated

$auth = false;

$user = $_SERVER['PHP_AUTH_USER'];

$pass = $_SERVER['PHP_AUTH_PW'];

if ( isset($user) && isset($pass) )

{

//connect to db

include 'db_connect.php';

//SQL query to find if this entered username/password is in the db

$sql = "SELECT * FROM healthed_workshop_admin WHERE

user = '$PHP_AUTH_USER' AND

pass = '$PHP_AUTH_PW'";

//put the SQL command and SQL instructions into variable

$result = mysql_query($sql) or die('Unable to connect.');

//get number or rows in command; if more than 0, row is found

$num_matches = mysql_num_rows($result);

if ($num_matches !=0)

{

//matching row found authenticates user

$auth = true;

}

}

if (!$auth)

{

header('WWW-Authenticate: Basic realm="Health Ed Presentation Admin"');

header('HTTP/1.0 401 Unauthorized');

echo 'You must enter a valid username & password.';

exit;

}

else

{

echo 'Success!';

}

?>

