Re: login page + .htaccess

>I have this situation, One on my directory is protected by .htaccess file, >it use only one pair of username and password. I also have a login page to >maintain a list of members who logged in my site. > >I want to do this: If the user is not logged in and try to access the >protected directory, it pop up a window and ask for the password (done by >htaccess). >Once a user is logged in and access the directory, it bypass the popup >windows > >Can i do it with this code? i tried but not works > >if ($_SESSION['logged']){ > $_SERVER['PHP_AUTH_USER']="username"; > $_SERVER['PHP_AUTH_PW']="password"; >} No. PHP_AUTH_USER and PHP_AUTH_PW are "one way" only -- coming *FROM* the browser *TO* PHP. To be more precise -- Whatever a visitors types into the HTTP Auth popup dialog that "works" and grants them access, will continually be re-presented by the browser as their username/password. Your "setting" of $_SERVER['PHP_AUTH_USER'] and _PW doesnt' change *anything* as far as the browser is concerned. Essentially, you are simply confusing yourself about what is in those variables, rather than dealing with the reality of what the browser is telling you. If you need more than a handful of username/password combinations, it's easier to just use PHP's HTTP Authentication than mucking with .htaccess, IMNSHO. There is crude sample code on PHP's web-site for the HTTP Auth part, and a zillion more examples in the code archives that also incorporates the MySQL part. If you're trying to tackle both MySQL as a new topic and HTTP Auth at the same time, it can be a bit painful... But it's still not *that* tricky. Other options I've never bothered with are things like mod_auth_mysql where Apache and MySQL conspire to handle authentication without mucking with PHP. -- Like Music? http://l-i-e.com/artists.htm