note 11363 deleted from features.http-auth by irc-html

I don't think I've seen this on here. If you need to check a database, use something like this. If they aren't in the database, this will effectively erase their previous login information so they can try again if they want, *without* requiring them to close their browser, since all it does is rotate the realm with a timestamp. You can extrapolate this to a logout procedure as well. It still pops up the login box, but apparently that just serves to clear it out when there's already something there, because for me I couldn't get it to log me in after the database query failed. I had to let the second www-authorization fail, and then reload, and then it would log me in after I put in correct information. It's annoying, but by God I didn't have to close my browser. &lt;?php //if they haven't logged in yet, or they need to do it again if (!isset($PHP_AUTH_USER) || $unauthorized) { $realm = "myrealm_".time(); Header("WWW-Authenticate: Basic realm=\"$realm\""); Header("Status: HTTP/1.0 401 Unauthorized"); print "<h1>401 Unauthorized</h1>Unable to authorize you. Please <a href=\"$PHP_SELF\">click here</a> to try again."; exit; } else // if they're not in the database, re-authenticate { //database query here if(not found) { header("Location: ".$PHP_SELF."?unauthorized=1"); exit(); } } echo "you are authorized<br>Click <a href=\"login.php?unauthorized=1\">here</a> to log out."; ?>