PHP-based Authentication From: http://www.zend.com/zend/tut/authentication.php
Methods to implement Authentication Basic Authentication Session Based Authentication (see in session) Basic Authentication Session Based Authentication
Compare..
Basic Authentication When you explicitly send the appropriate HTTP headers from a PHP script to a Web browser an authentication dialog box will be displayed. The dialog box prompts you to enter a username and password. PHP assigns the username and password entered to the global variables $_SERVER[‘PHP_AUTH_USER’] and $_SERVER[‘PHP_AUTH_PW’], respectively.
Header() PHP header() function enables you to output a specific HTTP header string, such as a location redirection, or in our case, a "401" response code: "Unauthorized“ This type of header, combined with a "WWW-Authenticate" header, will activate an authentication dialog box.
EX1 : <?php header('WWW-Authenticate: Basic realm="Private"'); header('HTTP/1.0 401 Unauthorized'); exit; ?>
EX2: <?php if ((!isset( $_SEVER[‘PHP_AUTH_USER’] )) || (!isset($_SERVER[‘PHP_AUTH_PW’]))) { header( 'WWW-Authenticate: Basic realm="Private"' ); header( 'HTTP/1.0 401 Unauthorized' ); echo 'Authorization Required.'; exit; } else { echo "You entered {$_SERVER[‘PHP_AUTH_USER’] }for a username.<BR>"; echo "You entered {$_SERVER[‘PHP_AUTH_PW’]} for a password.<BR>"; } ?>
Using Hard-Coded Values <?php if ( ( !isset( $_SERVER['PHP_AUTH_USER'])) || (!isset($_SERVER['PHP_AUTH_PW'])) || ( $_SERVER['PHP_AUTH_USER'] != 'user' ) || ( $_SERVER['PHP_AUTH_PW'] != 'open' ) ) { header( 'WWW-Authenticate: Basic realm="Private"' ); header( 'HTTP/1.0 401 Unauthorized' ); echo 'Authorization Required.'; exit; } else {echo 'Success!';} ?>
PHP-based authentication isn't like PHP-based authentication isn't like .htaccess or server-based authentication A layer of security is not placed over all the contents of an entire directory
EX: redirect after success <?php if ( ( !isset( $_SERVER['PHP_AUTH_USER'] )) || (!isset($_SERVER['PHP_AUTH_PW'])) || ( $_SERVER['PHP_AUTH_USER'] != 'user' ) || ( $_SERVER['PHP_AUTH_PW'] != 'open' ) ) { header( 'WWW-Authenticate: Basic realm="Private"' ); header( 'HTTP/1.0 401 Unauthorized' ); echo 'Authorization Required.'; exit; } else { header( 'Location: http://www.cs.su.ac.th/~wasara/517412' ); } ?>
EX : print HTML after success <?php if((!isset($_SERVER['PHP_AUTH_USER']))||(!isset($_SERVER['PHP_AUTH_PW']))||($_SERVER['PHP_AUTH_USER']!= 'user')||($_SERVER['PHP_AUTH_PW']!='open')) { header( 'WWW-Authenticate: Basic realm="Private"' ); header( 'HTTP/1.0 401 Unauthorized' ); echo 'Authorization Required.'; exit; } else { echo ‘ <HTML><HEAD><TITLE>Secret Stuff</TITLE></HEAD> <BODY> <H1>SECRET!</H1> <P>This is a secret message.</P> </BODY> </HTML>'; }
In re-direction and links, can add parameters: header("Location:page2 In re-direction and links, can add parameters: header("Location:page2.php?user=$username"); For encrypt in php: crypt(), md5()
See also : Validate Username/Passwords Using a Flat File Validate Username/Passwords Using a .htpasswd File Validate Username/Passwords Using a Database