note 17415 added to features.http-auth

There seems to be a lot of trouble just to authorise users going on here. I know it may not seem "satisfactory" to use a HTML form with an authentication script, when you can have a fancy pop-up box to enter your username and password into, but doing it this way, you get complete control: 1) User enters username and password on the HTML form, and clicks "Log in" 2) Your authentication script compares the username and password to those in the database. 3) If successful set a session variable to represent the user logged in (Maybe "authorised=1" or something) 4) On any pages requiring security, include a cheque to see if the session variable has been set. For increased security, you may want to explicitly check the HTTP_SESSION_VARS global array, rather than the authorised variable itself, as it would be possible for someone to trick the page from the URL. To log someone out, you simply use session_destroy(), and to time someone out, you can either set the time out in the php.ini file, or register a timestamp, and each time you check the authorisation, check the timestamp as well. I feel this is not only a decent alternative to what people here are trying, but is actually more secure if you are careful with what you are doing. -- http://www.php.net/manual/en/features.http-auth.php http://master.php.net/manage/user-notes.php?action=edit+17415 http://master.php.net/manage/user-notes.php?action=delete+17415 http://master.php.net/manage/user-notes.php?action=reject+17415