Re: AUTH (.htaccess style)
| From: | Sebastian | Date: | Fri, 21 Feb 2003 01:25:51 +0000 |
| Subject: | Re: AUTH (.htaccess style) | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-136445@lists.php.net to get a copy of this message | ||
Can someone test this code, It prompts to login, but does not accept my username and or password ..
I have a feeling its a server configuration problem but i need someone to help me confirm it.
Running php version 4.2.3. Apache/1.3.27 - I have tried using $_SERVER['PHP_AUTH_USER']
and $HTTP_SERVER_VARS['PHP_AUTH_USER'] .. neither works =\
I am just including this script into a script I want to protect.
Thanks.
<?php
$checkservername = "localhost";
$dbcheckusername = "";
$dbcheckpassword = "";
$dbcheckbase = "";
$encryptedpw = true; // password encrypt? (md5)
$realm = "This site is private!";
$auth = false;
if (isset( $PHP_AUTH_USER ) && isset($PHP_AUTH_PW)) {
mysql_connect( $checkservername, $dbcheckusername, $dbcheckpassword )
or die ( 'Unable to connect to server.' );
mysql_select_db( $dbcheckbase )
or die ( 'Unable to select database.' );
if ($encryptedpw) {
$chkpw = md5($PHP_AUTH_PW);
} else {
$chkpw = $PHP_AUTH_PW;
}
$sql = ("SELECT * FROM user WHERE username = '$PHP_AUTH_USER' AND password =
'$chkpw' AND (usergroupid = '6')");
$result = mysql_query( $sql )
or die ( 'Unable to execute query.' );
$num = mysql_numrows( $result );
if ( $num != 0 ) {
$auth = true;
}
}
if ( ! $auth ) {
header( "WWW-Authenticate: Basic realm=\"$realm\"" );
header( "HTTP/1.0 401 Unauthorized" );
echo 'Authorization Required!';
exit;
}
?>
----- Original Message -----
From: Sebastian
To: php-general@lists.php.net
Sent: Thursday, February 20, 2003 4:34 AM
Subject: AUTH (.htaccess style)
Greetings.
I have a member system which each user has a unique ID, username and password.
I want to secure some of my scripts with .htaccess style login, Basically I would like to fetch
the username and password from mysql database, the password is encrypt using md5 hash.
I would like to the ability to include the file into any script I would like to protect and
validate the user based on the information that is stored on the mysql database.
Conclusion: Does anyone know of a handy script that I could use?
Thanks in advanced.