PHP newbies on the road (7)_PHP tutorial

Build a simple interactive website (3)

6. Password verification

Maybe you want to put your photo collection on your website and only want to show it to your close friends. This when you need a password verification program.

6.1 Based on HTTP verification

How to use PHP to implement password verification? We can use short PHP code to force authentication by sending an HTTP header using the function header(), and the client browser will pop up a dialog box for entering the username and password. In PHP, the information entered by the client user is automatically saved in the three global variables $PHP_AUTH_USER, $PHP_AUTH_PW, and $PHP_AUTH_TYPE after it is transmitted to the server. Using these variables, we can authenticate the user's identity based on the user account information that the implementation saves in a data file or database.

However, users need to be reminded here that only when running in Apache module mode, PHP scripts can use the three variables $PHP_AUTH_USER, $PHP_AUTH_PW, and $PHP_AUTH_TYPE. If the user is using PHP in CGI mode, the HTTP-based authentication function cannot be implemented.

6.2 Next, we will introduce in detail how to use PHP to verify user identity.

In the following example, we use the two variables $PHP_AUTH_USER and $PHP_AUTH_PW to verify whether the entrant is legal and allow entry. In this example, the user name and password pairs allowed to log in are tnc and nature respectively:
if(!isset($PHP_AUTH_USER))
{
Header("WWW-Authenticate : Basic realm="My Realm"");
Header("HTTP/1.0 401 Unauthorized");
echo "Text to send if user hits Cancel buttonn";
exit;
}
else
{
if ( !($PHP_AUTH_USER=="tnc" && $PHP_AUTH_PW=="nature") )
{
// If it is a wrong username/password pair, Force re-authentication
Header("WWW-Authenticate: Basic realm="My Realm"");
Header("HTTP/1.0 401 Unauthorized");
echo "ERROR : $PHP_AUTH_USER/$PHP_AUTH_PW is invalid.";
exit;
}
else
{
echo "Welcome tnc!";
}
?>

In fact In actual reference, it is unlikely to use the obvious username/password pairs in the code snippet above, but instead use a database or encrypted password file to access them.

6.3 Verify user identity based on specified verification information

First, we can use the following code to determine whether the user has entered the username and password, and display the information entered by the user.


if (!isset($PHP_AUTH_USER)) {

header('WWW-Authenticate: Basic realm="My Private Stuff"');

header('HTTP/1.0 401 Unauthorized');

echo 'Authorization Required.';

exit;

}

else {

echo "

You have entered this username: $PHP_AUTH_USER


You have entered this password: $PHP_AUTH_PW


The authorization type is: $PHP_AUTH_TYPE

";

}

?>

Description: The
isset() function is used to determine whether a variable has been assigned a value. Returns true or false depending on whether the variable value exists.
The header() function is used to send specific HTTP headers. Note that when using the header() function, be sure to call it before any HTML or PHP code that produces the actual output.

Although the above code is quite simple and does not effectively validate the username and password entered by the user based on any actual values, at least we understand how to use PHP to generate an input dialog box on the client side.

Next, let’s take a look at how to verify the user’s identity based on the specified verification information. The code is as follows:


if (!isset($PHP_AUTH_USER)) {

header('WWW-Authenticate: Basic realm="My Private Stuff" ');

header('HTTP/1.0 401 Unauthorized');

echo 'Authorization Required.';

exit;

}

else if (isset($PHP_AUTH_USER)) {

if (($PHP_AUTH_USER != "admin") || ($PHP_AUTH_PW != "123")) {

header('WWW-Authenticate: Basic realm="My Private Stuff"');

header('HTTP/1.0 401 Unauthorized');

echo 'Authorization Required.';

exit;

} else {

echo "

You're authorized!

";

}

}

?>

Here, we first check whether the user has entered the user name and password. If not, a corresponding dialog box will pop up asking the user to enter identity information. Subsequently, we grant the user access rights or prompt the user to enter the correct information again by determining whether the information entered by the user matches the specified user account admin/123. This method works for sites where all users use the same login account.

6.4 Another simple password verification

If you are writing and running your PHP script under windows98, or if you follow the default settings under Linux, install PHP as a For CGI programs, you will not be able to use the above PHP program to implement the verification function. For this reason, Wubian provides you with another simple password verification method. Although it is not very practical, it is still good for learning.
$password = "123";

// check password
if($pass != $password)
{
echo "< html> ";
echo "

";
echo "Please enter your administrative password:
";
echo "";
echo "";
echo "

";
}
else
{
echo "< ;html> ";
echo "<script>"; <br>echo 'window. location="http://gophp.heha.net/test/index.php3"'; <br># The page transferred after password verification<br>echo "</script>";

}
?>