An example of code for php to simulate http identity authentication

The code is as follows:

<?   
// 检查变量 $PHP_AUTH_USER 和$PHP_AUTH_PW 的值   
if ((!isset($PHP_AUTH_USER)) || (!isset($PHP_AUTH_PW))) {   
// 空值：发送产生显示文本框的数据头部   
    header('WWW-Authenticate: Basic realm="My Private Stuff"');   
    header('HTTP/1.0 401 Unauthorized');   
    echo 'Authorization Required.';   
    exit;    
}    
else if ((isset($PHP_AUTH_USER)) && (isset($PHP_AUTH_PW))){    
    // 变量值存在，检查其是否正确    
    if (($PHP_AUTH_USER != "username") || ($PHP_AUTH_PW != "password")) {   
    // 用户名输入错误或密码输入错误，发送产生显示文本框的数据头部   
    header('WWW-Authenticate: Basic realm="My Private Stuff"');   
    header('HTTP/1.0 401 Unauthorized');   
    echo 'Authorization Required.';   
    exit;  //by http://bbs.it-home.org
}    
else if(($PHP_AUTH_USER == "username") || ($PHP_AUTH_PW == "password")) {   
 // 用户名及密码都正确，输出成功信息    
 echo "<P>You're authorized!</p>";   
}   
}    
?>

Attached, instructions for implementing basic identity authentication in PHP.

A basic authentication mechanism can be created by combining the header() function with the $PHP_AUTH_USER and $PHP_AUTH_PW global variables. Usually the server-based authentication request/response process is as follows: 1. The user requests a file from a Web server. If the file is within a protected area, the server responds by adding a 401 (Illegal User) string to the header of the response data. 2. After the browser sees the response, a username/password dialog box pops up. 3. The user enters the user name and password in the dialog box, and then clicks "OK" to send the information back to the server for authentication. 4. If the username and password are valid, the protected files will be displayed to the user. This confirmation will remain valid for as long as the verified user is within the protected area.

A simple PHP script can simulate the HTTP authentication request/response system by sending the appropriate HTTP headers to automatically display the username/password dialog on the client screen. PHP stores user input dialog information in the $PHP_AUTH_USER and $PHP_AUTH_PW variables.

By using these variables, you can store the list of non-compliant username/password checks in a text file, database, or anywhere you wish.

Note: The $PHP_AUTH_USER, $PHP_AUTH_PW and $PHP_AUTH_TYPE global variables are only valid when PHP is installed as a module. If you are using the CGI version of PHP, you will be limited to using htaccess-based authentication or database-based authentication, and letting users enter their username and password through an HTML form, and then letting PHP complete the validity check.

The above example shows a validation check for two hardware-encoded values, which are theoretically identical regardless of where the username and password are stored.

I hope the above demo code will be helpful for everyone to understand how PHP simulates HTTP identity authentication.