Re: Trouble with PHP server script

Robert Cox wrote:

Is it possible to use the "$_SERVER['PHP_AUTH_USER'];" construct in a URL forwarded site? I am trying to find the authorised user id so that I can access an SQL database with it. Anyone got some ideas? PHP looks like this.... <?php //Get User $user = $_SERVER['PHP_AUTH_USER']; // Get User type $db = mysql_connect(localhost, ....., .....) or die("Can't connect to database: ".mysql_error());

        mysql_select_db(................) or die("Can't select database:

".mysql_error());

You should always run mysql_real_escape_string() on any variables that you use in an SQL statement.

$query = "SELECT * FROM user WHERE staffid LIKE $user";

You need to make sure that you surround your string with quotes. This is only if the $user is a string, if it is an int/number, the forget the quotes. $query = "SELECT * FROM user WHERE staffid LIKE '$user'"; The following should always reference your above DB resource $db Plus, this isn't how you should be checking for a valid user. The following would only hit the die() statement if there was an error with the SQL statement. Not if it didn't return any results. mysql_query($query, $db) or die('Not a valid user: '.mysql

$result = mysql_query($query) or die ('Not a valid User: ' . mysql_error()); .... ?>

Note: You need to make sure that magic_quotes_gpc is not enabled. That will mess with doing things this way. Note: I am assuming that you will only match one and only one. If that is the case you need to switch the like to an = instead. staffid = '{$user}' don't worry about the curly braces, they are for PHP to identify the variable. They wont show up in your actual SQL statement. All that being said, try this instead. <?php // Get User type $db = mysql_connect(localhost, ....., .....) or die("Can't connect to database: ".mysql_error()); mysql_select_db(................) or die("Can't select database: ".mysql_error()); //Get User $user = mysql_real_escape_string(@$_SERVER['PHP_AUTH_USER'], $db); $query = "SELECT * FROM user WHERE staffid = '{$user}'"; $result = mysql_query($query, $db) or die('Error with query: '.mysql_error()); if ( mysql_num_rows($result) == 0 ) { // No results found, assume user does not exist } else { // User exists, do something about it. } .... ?>