Re: getting rid of form variable definition

scottrus@ipass.net writes: >Danny - > >Then you want to call unset($reauthenticate) some where after >you complete your auth function. Problem with this is that the auth function does: Header( "WWW-authenticate: basic realm=\"$realm\""); Header( "HTTP/1.0 401 Unauthorized"); which causes the browser to popup the user/password prompt and then resubmits the script with its previous variables. Variables you unset in the current script are irrelevant because the script is recalled and the browser passes the variables it passed the previous call (I believe this is what happens) plus the updated $PHP_AUTH_USER and $PHP_AUTH_PW variables. I wonder if you can get the browser not to send back the previous variables; but only the $PHP_AUTH_USER and $PHP_AUTH_PW. >Side note. Be sure you check that you're pulling in the >POST var $reauthenticate and not something else like the >GET var $reauthenticate. In php4 you can do this: > > newauth = $HTTP_POST_VARS["reauthenticate"]; > >If you don't, a user might pull something like this on you: > > http://www.mysite.com/auth_script.php?reauthenticate=username > >and PHP would happily fill $reauthenticate with 'username'. > >The standard order for var population in php4 is GET, POST, Cookies >iirc. > >On Mon, Jul 03, 2000 at 01:40:28PM -0500, Danny Rice wrote: >> Sorry about my lack of clarity, $reauthenticate was set via >> <INPUT TYPE=SUBMIT NAME=reauthenticate VALUE="Change User"> >> >> After authentication() I would like the reauthenticate variable to go >> away. > >-- > Scott > >-- >PHP General Mailing List (http://www.php.net/) >To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net >For additional commands, e-mail: php-general-help@lists.php.net >To contact the list administrators, e-mail: php-list-admin@lists.php.net