Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations gkittelson on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Password protection

Status
Not open for further replies.

xaza

MIS
Feb 28, 2005
2
US
Hi guys. I'm new to this board and don't know anything about PHP. So I apologize if my questions are too basic for this board.

I am just trying to password protect a webpage. I downloaded a script from: I followed the instruction, however I am getting the following errors:

Notice: Undefined index: SERVER_ADMIN in C:\Inetpub\ on line 12

Notice: Undefined variable: PHP_AUTH_USER in C:\Inetpub\ on line 16

Warning: Cannot modify header information - headers already sent by (output started at C:\Inetpub\ in C:\Inetpub\ on line 17

Warning: Cannot modify header information - headers already sent by (output started at C:\Inetpub\ in C:\Inetpub\ on line 18

I have IIS and PHP set up.
Could any of you tell me what I need to do to make this work? I am pasting the script below.
Thanks a bunch!

//===============================
//put the following line in the PHP page you want to protect:include ("./p_protect.php");
//===============================

<?php

$selfSecure = 1;
$shellUser = "demo";
$shellPswd = "demo";

$adminEmail = "jislam@unitrin.com";
$fromEmail = $HTTP_SERVER_VARS["SERVER_ADMIN"];

$Version = "Your details here (for example The Webmaster - webmaster@xxx.com)";
if($selfSecure){
if (($PHP_AUTH_USER!=$shellUser)||($PHP_AUTH_PW!=$shellPswd)) {
Header(' Basic realm="MCE Web ADMIN only!"');
Header('HTTP/1.0 401 Unauthorized');
echo "<html>
<head>
<title>Error - Access Denied</title>
</head>
<h1>Access denied</h1>
A warning message has been sent to the webmaster. Your IP address has also been recorded
<hr>
<em>$Version</em>";
if(isset($PHP_AUTH_USER)){
$warnMsg ="
Somebody tried to access the script on: ["HTTP_HOST"]."$PHP_SELF
using the wrong username or password:

Date: ".date("Y-m-d H:i:s")."
IP: ".$HTTP_SERVER_VARS["REMOTE_ADDR"]."
User Agent: ".$HTTP_SERVER_VARS["HTTP_USER_AGENT"]."
username used: $PHP_AUTH_USER
password used: $PHP_AUTH_PW

";
mail($adminEmail,"Unauthorized Access",$warnMsg,
"From: $fromEmail\nX-Mailer:$Version AutoWarn System");
}
exit;
}
}

if(!$oCols)$oCols=$termCols;
if(!$oRows)$oRows=$termRows;

?>
 
Line 12: $fromEmail = $HTTP_SERVER_VARS["SERVER_ADMIN"];
Line 16: if (($PHP_AUTH_USER!=$shellUser)||($PHP_AUTH_PW!=$shellPswd)) {

Line 17: Header(' Basic realm="MCE Web ADMIN only!"');

Line 18: Header('HTTP/1.0 401 Unauthorized');

Thanks.
 
That script isn't going to do what you need.

The superglobal array elements $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'], are, according to the PHP online manual, available only when running PHP as an Apache module.

Want the best answers? Ask the best questions!

TANSTAAFL!!
 
Here's the simple solution, but the details are left to the student:

1) write a form with a username and password and have it submit to a login.php script.
2) make an include file that starts a session ( session_start() ) and checks a variable, e.g. "isSet( $_SESSION[ 'loggedin' ] )" and if it is, fall through the end, if it isn't, require() your login form and exit.
3) in the login.php for test the username and password for validity ( use $_REQUEST[ 'name of field from form' ] ) and if they match, set $_SESSION[ 'loggedin' ], otherwise print an error and include you login form again.

That's it in a nutshell.
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top