Rozdział 34. Autoryzacja HTTP w PHP

Autoryzacja HTTP jest obsługiwana przez PHP tylko wtedy, gdy PHP pracuje jako moduł Apache'a, nie jest dostępna w trybie CGI. W skrypcie można użyć funkcji header() by wysłać do przeglądarki komunikat "Wymagana autoryzacja", co spowoduje wyświetlenie okienka z polami Użytkownik i Hasło. Po wypełnieniu przez użytkownika tych pól, URL zawierający skrypt PHP zostanie ponownie wywołany z ustawionymi predefiniowanymi zmiennymi PHP_AUTH_USER, PHP_AUTH_PW i PHP_AUTH_TYPE zawierającymi odpowiednio nazwę użytkownika, hasło i typ autoryzacji. Zmienne te będą dostępne w tablicach $_SERVER oraz $HTTP_SERVER_VARS. Obecnie obsługiwana jest jedynie autoryzacja typu "Basic". Więcej informacji znajdziesz w opisie funkcji header().

Przykładowy skrypt wymuszający autoryzację klienta:

Przykład 34-1. Autoryzacja HTTP


<?php

  if (!isset($_SERVER['PHP_AUTH_USER'])) { 

    header('WWW-Authenticate: Basic realm="My Realm"');

    header('HTTP/1.0 401 Unauthorized');

    echo 'Tekst do wysłania, jeśli użytkownik wciśnie przycisk Anuluj';

    exit;

  } else {

    echo "<p>Hej {$_SERVER['PHP_AUTH_USER']}.</p>"; 

    echo "<p>Twoje hasło to {$_SERVER['PHP_AUTH_PW']}.</p>"; 

  }

?>

Kompatybilność: Należy uważać z linijkami dodawanymi do nagłówka HTTP. W celu zachowania maksymalnej zgodności ze wszystkimi klientami, słowo Basic powinno zaczynać się dużą literą "B", wartość realm powinna być otoczona cudzysłowami (nie apostrofami), i dokładnie jeden znak odstępu powinien poprzedzać kod 401 w linii HTTP/1.0 401.

Zamiast wyświetlać wartość PHP_AUTH_USER i PHP_AUTH_PW, jak to zrobiono w powyższym przykładzie, zechcesz zapewne sprawdzić poprawność nazwy użytkownika i hasła. Na przykład poprzez zapytanie do bazy danych lub odnalezienie użytkownika w pliku dbm.

Należy uważać na kapryśne przeglądarki Internet Explorer. Są wrażliwe na kolejność wysyłanych nagłówków HTTP. Wysłanie nagłowka WWW-Authenticate przed HTTP/1.0 401 powinno rozwiązać problem.

Aby zapobiec sytuacji w której ktoś napisze skrypt wykradający hasło wysłane tradycyjnym zewnętrznym mechanizmem, zmienne PHP_AUTH nie będą ustawiane, jeśli dla danej strony aktywna jest autoryzacja zewnętrzna. W tym wypadku, aby uzyskać nazwę użytkownika zautoryzowanego zewnętrznie, należy skorzystać ze zmiennej REMOTE_USER. Zatem, $_SERVER['REMOTE_USER'].

Konfiguracja: Aby wykryć czy miała miejsce zewnętrzna autoryzacja, PHP sprwadza obecność dyrektywy AuthType. Pamiętaj zatem, by nie stosować tej dyrektywy w miejscach, gdzie będzie używana autoryzacja PHP. Inaczej każda próba autoryzacji zakończy się niepowodzeniem.

Powyższa metoda nie zapobiega jednak wykradaniu haseł do stron wymagających autoryzacji przez kogoś, kto na tym samym serwerze kontroluje strony nie wymagające autoryzacji.

Zarówno Netscape Navigator jak i Internet Explorer opróżnią bufor autoryzacji po otrzymaniu od serwera kodu 401. Można w ten sposób wylogowanić użytkownika i zmusić go do ponownego wysłania nazwy użytkownika i hasła. Tej metody można użyć do wylogowania użytkownika po określonym czasie lub stworzenia przycisku "Wyloguj".

Przykład 34-2. Autoryzacja HTTP z wymuszeniem przelogowania


<?php

  function authenticate() {

    header('WWW-Authenticate: Basic realm="Testowy system autoryzacji"');

    header('HTTP/1.0 401 Unauthorized');

    echo "Musisz podać poprawny login i hasło by wejść na tę stronę\n";

    exit;

  }

 

  if (!isset($_SERVER['PHP_AUTH_USER']) || ($_POST['SeenBefore'] == 1 && $_POST['OldAuth'] == $_SERVER['PHP_AUTH_USER'])) {

   authenticate();

  } 

  else {

   echo "<p>Witaj: {$_SERVER['PHP_AUTH_USER']}<br>";

   echo "Poprzenio: {$_REQUEST['$OldAuth']}";

   echo "<form action='{$_SERVER['PHP_SELF']}' METHOD='POST'>\n";

   echo "<input type='hidden' name='SeenBefore' value='1'>\n";

   echo "<input type='hidden' name='OldAuth' value='{$_SERVER['PHP_AUTH_USER']}'>\n";

   echo "<input type='submit' value='Re Authenticate'>\n";

   echo "</form></p>\n";

  }

?>

Powyższa metoda nie jest wymagana przez autoryzację HTTP typu "Basic", więc nie można na niej polegać. Testy z przeglądarką Lynx pokazały, że Lynx nie usuwa danych o autoryzacji po odebraniu od serwera kodu 401, zatem przejście wstecz a następnie do przodu otworzy stronę, chyba, że wymagania co do danych autoryzacji zmieniły się. Użytkownik może jednak użyć klawisza '_' by usunąc dane o autoryzacji.

Autoryzacja HTTP nie działa jeśli używasz serwera Microsoft IIS i PHP w wersji CGI. Powodem są pewne ograniczenia IIS.

Notatka: Jeśli włączony jest tryb bezpieczny, uid skryptu jest doklejany do pola realm nagłówka WWW-Authenticate.

User Contributed Notes


I came up with another approach to work around the problem of browsers caching WWW authentication credentials and creating logout problems. While most browsers have some kind of way to wipe this information, I prefer having my website to take care of the task instead of relying on the user's sanity.



Even with Lalit's method of creating a random realm name, it was still possible to get back into the protected area using the back button in Firefox, so that didn't work. Here's my solution:



Since browsers attach the credentials to specific URLs, use virtual paths where a component of the path is actually a PHP script, and everything following it is part of the URI, such as:



http://www.example.com/some_dir/login.php/auth/8f631b92/



By choosing a different number for the last component of the URL, browsers can be tricked into thinking that they are dealing with a completely different website, and thus prompting the user for credentials again.



Note that using a random, unrestricted number will still allow the user to hit the back button to get back into the page. You should keep track of this number in a server-side file or database and regenerate it upon each successful login, so that the last number(s) become invalid. Using an invalid number might result in a 403 response or, depending on how you feel that day, a 302 to a nasty website.



Care should be taken when linking from the page generated in this case, since relative links will be relative to the virtual and non-existant directory rather than the true script directory.



Hope this helps somebody.


A simpler approach on the post of:

bernard dot paques at bigfoot dot com

24-Sep-2004 01:42



This is another "patch" to the PHP_AUTH_USER and PHP_AUTH_PW server variables problem running PHP as a CGI.



First of all don't forget this fragment of code in your .htaccess (it's the only thing you need to make it work with mod_rewrite):



<IfModule mod_rewrite.c>

   RewriteEngine on

   RewriteRule .* - [E=REMOTE_USER:%{HTTP:Authorization},L]

</IfModule>



Then login.php



<?php

$a = base64_decode( substr($_SERVER["REMOTE_USER"],6)) ;

if ( (strlen($a) == 0) || ( strcasecmp($a, ":" )  == 0 ))

{

   header( 'WWW-Authenticate: Basic realm="Private"' );

   header( 'HTTP/1.0 401 Unauthorized' );

}

else

{

   list($name, $password) = explode(':', $a);

   $_SERVER['PHP_AUTH_USER'] = $name;

   $_SERVER['PHP_AUTH_PW']    = $password;



}



echo 'PHP_AUTH_USER =' . $_SERVER['PHP_AUTH_USER'] . '<br>';

echo 'PHP_AUTH_PW =' . $_SERVER['PHP_AUTH_PW'] . '<br>';

echo 'REMOTE_USER =' . $_SERVER['REMOTE_USER'] . '<br>';

?>



First, we decode the base64 encoded string discarding the first 6 characters of "Basic " and then we do a regular validation.

At the end of the script we print the variables to verify it's working. This should be ommited in the production version.



It's a variation of the script by Bernard Paques.

Thanks to him for that snippet.


/**

After many tries, I created a login/logout-mechanism, which works

with Internet Explorer (tested on IE6) and Firefox (tested on V1.0).



I've combined some of the hints given below and used a session as

a second independent memory.



check4login() has to be called on every loading of the page.

 **/



function check4login() {



    $baselink = "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'];



    // start a session and don't let it stop automatically:

    session_set_cookie_params(0);

    session_start();

    setcookie("PHPSESSID", session_id());



    // check if the current loading of the page is the first loading

    // after a logout:

    if ($_SESSION['logout'] != '') {

        unset($_SESSION['logout']);

        //

        // initialize a relogin on Firefox

        // (request login with username "relogin"):

        //

        // CAUTION: After that, relative hyperlinks like

        //   <a href="{$_SERVER['PHP_SELF']}">Link</a>

        // will maybe translated into an absolute hyperlink like

        //   http://relogin:relogin@...

        // which will lead to an error-message in Firefox.

        //

        // So you always have to use absolute hyperlinks like $baselink.

        //

        if (! preg_match("/MSIE/", $_SERVER['HTTP_USER_AGENT'])) {

            $link = preg_replace("/^http:\/\/(.*)$/",

                        "http://relogin:relogin@$1", $baselink);

            header("Location: $link");

            exit;

    }    }



    // check if a new realm needs to be generated because

    // it's the first loading of the page (or the first loading

    // after a logout):

    //

    // Remark: The realm is generated with some random signs,

    // because Internet Explorer will forget the username if the

    // realm changes. Unfortunately Firefox doesn't do so.

    if (! isset($_SESSION['realm'])) {

        srand();

        $_SESSION['realm'] = "My Realm      ";

        for ($i = 0; $i < 6; $i++) {

            $_SESSION['realm'] .= substr(".,:;-_'+~=", rand(0, 9), 1);

    }    }



    // check if a user has already logged in before:

    if (isset($_SESSION['user'])) {

        unset($_SESSION['login']);

        return true;

    }



    // check if a user just entered a username and password:

    //

    // is_authorized() has to return 'true' if and only if

    // the username and the passwort given are correct.

    if (isset($_SESSION['login'])) {

        if (is_authorized($_SERVER['PHP_AUTH_USER'],

                    $_SERVER['PHP_AUTH_PW'])) {

            $_SESSION['user'] = $_SERVER['PHP_AUTH_USER'];

            unset($_SESSION['login']);

            return true;

    }    }



    // let the browser ask for a username and a password:

    $_SESSION['login'] = true;

    header("WWW-Authenticate: Basic realm=\"{$_SESSION['realm']}\"");

    header("HTTP/1.0 401 Unauthorized");

    echo "You need to log in before you can access this page.";

    phpinfo();        // - for testing only

    exit;

}



function logout() {



    // to do a logout, all session-variables will be deleted,

    // a variable 'logout' is added:

    $_SESSION = array('logout' => true);

    echo "You were successfully logged out.";

    phpinfo();        // - for testing only

    exit;

}


This forces an instant re-authentication:



// Force a logout.

function imt_logout()

{

    global $_SESSION;

    global $HTTP_SERVER_VARS;

    global $PHP_SELF;

    

    // We mark the session as requiring a re-auth

    $_SESSION['reauth-in-progress'] = 1;



    // This forces the authentication cache clearing

    header("WWW-Authenticate: Basic realm=\"My Realm\"");

    header("HTTP/1.0 401 Unauthorized");

    

    // In case of the user clicks "cancel" in the dialog box

    print '<a href="http://'.$HTTP_SERVER_VARS['HTTP_HOST'].$PHP_SELF.'">click me</a>';

    exit();

}



// Check login

function imt_login()

{

    global $_SERVER;

    global $_SESSION;

    global $REGISTERED_USERS;



    // the valid_user checks the user/password (very primitive test in this example)

    if (!valid_user($_SERVER['PHP_AUTH_USER'], $REGISTERED_USERS))

    {

        session_destroy();

        header("WWW-Authenticate: Basic realm=\"My Realm\"");

        header("HTTP/1.0 401 Unauthorized");

        exit();

    }



    // OK, the user is authenticated

    $_SESSION['user'] = $_SERVER['PHP_AUTH_USER'];

}



Assuming that your page.php?action=logout forces a reauth on the same page, start your page with:



session_start()

if ($_REQUEST["action"] == "logout")

{

    if (isset($_SESSION['reauth-in-progress']))

    {

        session_destroy();

        header("Location: http://".$HTTP_SERVER_VARS['HTTP_HOST'].$PHP_SELF);

    }

    else

        imt_logout();

}

    

imt_login();


Don't like passwords at home or simply don't want access with passwords maybe told form one to another...



You make a configuration file like that:



# Passwort for special IP-Range

IP 192.168.0.

axel:PGWAiIeUxcHOg

sven:ADD1IDbsVHSEo



# Following IP works without password (Keyword 'ALL')

IP 192.168.0.4

ALL



# Passwords for the rest of the world

IP

ernst:INo9dSzfU5sRU

sven:ADD1IDbsVHSEo



<?

$path_log = "/home/ernst/.htmyway";



// Konfigurationsfile einlesen:

$file = file($path_log);



$login = FALSE;                    // Gets TRUE, when login is valid

$ip = 'world';                    // This is the currend IP while reading the configuration

$access = 'world';                // IP from configuration fitting into $_SERVER['REMOTE_ADDR']



foreach ($file as $zeile)

{

    $zeile = trim($zeile);



    switch(true)

    {

        case ( strlen($zeile) == 0 ):                // break for empty lines

            break;



        case ( substr($zeile, 0, 1) == '#' ):            // break for Komments

            break;



        case ( substr($zeile, 0, 2) == 'IP' ):        // change IP range

            $ip = substr($zeile, 3);

            if ($ip == '')

                $ip = 'world';



            if ( ereg("^$ip", $_SERVER['REMOTE_ADDR']) )    // fitting IP

            {

                $access = $ip;

            }

            break;



        case ( ereg("(.+):(.*)", $zeile, $reg) ):        // scan passwords

            $logray[$ip][$reg[1]] = $reg[2];

            break;



        case ( $zeile == 'ALL' ):                // if no login is needet

            $logray[$ip]['all'] = 1;

    }

}



// <for testing>

if ( isset($_GET['logout']) )

{

    unset($_SERVER['PHP_AUTH_USER']);

    unset($_SERVER['PHP_AUTH_PW']);

}

//   </for testing>



// authorisation test

if ( isset($_SERVER['PHP_AUTH_USER']) AND isset($_SERVER['PHP_AUTH_PW']) )

    if( isset($logray[$access][$_SERVER['PHP_AUTH_USER']]) )

        if( $logray[$access][$_SERVER['PHP_AUTH_USER']] == crypt($_SERVER['PHP_AUTH_PW'], (substr($logray[$access][$_SERVER['PHP_AUTH_USER']], 0, 2))) )

            $login = TRUE;



if ( isset($logray[$access]['all']) )

    $login = TRUE;



// send login-form if needet

if ( !$login )

{

    Header("WWW-Authenticate: Basic realm=\"Test Authentication System\"");

    Header("HTTP/1.0 401 Unauthorized");

    echo "You must enter a valid login ID and password to access this resource\n";

    exit;

}



// Your running programm...

if ( $login )

{

    echo "Hello " . $_SERVER['PHP_AUTH_USER'];



?>

<BR>

<form>

<input type='submit' name='logout' value='logout'>

</form>

<?



}

?>


The approach described in the manual works only at servers where PHP is ran as an Apache module. Where PHP is ran as a CGI module, credentials are always empty, whether the user actually fills the authentication box or not.



Apparently the set of Apache variables exposed to PHP is restricted when PHP runs in CGI mode, and this explains why $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'] are not set.



The solution is to select one Apache variable actually transmitted to PHP even in CGI mode, and to put in it authentication data submitted by the browser.



Look at the following directive added to the .htaccess file:



<IfModule mod_rewrite.c>

    RewriteEngine on

    RewriteRule .* - [E=REMOTE_USER:%{HTTP:Authorization},L]

</IfModule>



This directive states that, if mod_rewrite is available, credentials gathered from the HTTP header Authorization are put into the $_SERVER['REMOTE_USER'] variable.



To build up on RFC 2617 on HTTP Authentication, if the surfer wishes to send the userid "Aladdin" and password "open sesame", the browser will add the following header attribute to the HTTP request:



Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==



Thanks to the rewrite directive put in .htaccess, the triggered PHP script will catch credentials through $_SERVER['REMOTE_USER'] as follows:



$_SERVER['REMOTE_USER'] = Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==



From there all you have to do is to decode base64 credentials, and to split the string to retrieve user name and password, as described into the RFC 2617.



Before you use $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'], check if these variables are empty.



If yes, attempt to rebuild them by using $_SERVER['REMOTE_USER'].



The following snippet does exactly that:



<?php

// maybe we have caught authentication data in $_SERVER['REMOTE_USER']

if((!$_SERVER['PHP_AUTH_USER'] || !$_SERVER['PHP_AUTH_USER'])

    && preg_match('/Basics+(.*)$/i', $_SERVER['REMOTE_USER'], $matches)) {

    list($name, $password) = explode(':', base64_decode($matches[1]));

    $_SERVER['PHP_AUTH_USER'] = strip_tags($name);

    $_SERVER['PHP_AUTH_PW']    = strip_tags($password);

}

?>



The full script used to build a secured RSS feed is available here:



http://www.yetanothercommunitysystem.com/yacs/scripts/



Of course, this trick works only if the mod_rewrite module is available, and if you have changed the .htaccess file as explained above.


on the php+mysql auth code by tigran at freenet dot am



There are some security weaknesses.



First

$user 

  and 

$pass



are both insecure, they could leave this code open to SQL injection, you should always remove invalid characters in both, or at least encode them.



Actually storing passwords as MD5 hashes leaves you less work to secure.



Second security risks

The same mysql user has rights to both update and select, and possibly even insert and on your auth database no less.

Again the SQL inject attack may occur with this., and the end user could then change the users username, password, or anything else in relation to this.



Third items is more of a performance issue,

  

Do you really need to update the database, as updates are slower then selects, and if you do them every time they access the page, you are costing some speed penalty.  



One option, if you want to use sql (I think mysql has it) is memory only databases, and create a table within memory, the stores a unique session identifier for each user, that is logged in, or alternatively if it's a single front end system, you could use db files.


A simple script for SSL Client Certificate authentication with a basic authentication fall-back. I use this on my site using LDAP server to check username/passwords and client certificate to user mapping.



<? 

// Check if and how we are authenticated

if ($_SERVER['SSL_CLIENT_VERIFY'] != "SUCCESS") { // Not using a client certificate

    if ((!$_SERVER['PHP_AUTH_USER']) && (!$_SERVER['PHP_AUTH_PW'])) { // Not logged in using basic authentication

        authenticate(); // Send basic authentication headers

    }

}



if ($_SERVER['SSL_CLIENT_S_DN_CN'] != "chris") { // Check CN name of cert



    if (!(($_SERVER['PHP_AUTH_USER'] == "test") && ($_SERVER['PHP_AUTH_PW'] == "123"))) { // Check username and password

        authenticate(); // Send basic authentication headers because username and/or password didnot match

    } 

} 



phpinfo();



// Call authentication display

function authenticate() {

    Header("WWW-Authenticate: Basic realm=Website");

        Header("HTTP/1.0 401 Unauthorized");

        error401();

        exit;

}

?>



See my website (http://www.schaake.nu/index.php?page=/manuals/sslmanual.xml) for more details on client certificate with Apache and PHP.


Say you have password and groups files in standard Apache format (htpasswd etc.), but you want to apply authorization based on something other than filename, ie something you can't catch in .htaccess.  You want to emulate the server behavior in PHP -- the equivalent of:



AuthType Basic

AuthName "Members"

AuthUserFile /path/to/.htpasswd

AuthGroupFile /path/to/.groups

require group Members



Here's what I came up with:



<?PHP



$AuthUserFile = file("/path/to/.htpasswd");

$AuthGroupFile = file("/path/to/.groups");

$group = "Members";

$realm = "Members";



function authenticate(){

    header("WWW-Authenticate: Basic realm=\"$realm\"");

    header('HTTP/1.0 401 Unauthorized');

    echo "You must enter a valid user name and password to access the requested resource.";

    exit;

}



for(; 1; authenticate()){

    if (!isset($HTTP_SERVER_VARS['PHP_AUTH_USER']))

        continue;



    $user = $HTTP_SERVER_VARS['PHP_AUTH_USER'];

    if(!preg_grep("/$group: $user$/", $AuthGroupFile))  # (format assumptions)

        continue;



    if(!($authUserLine = array_shift(preg_grep("/$user:.*$/", $AuthUserFile))))

        continue;



    preg_match("/$user:((..).*)$/", $authUserLine, $matches);

    $authPW = $matches[1];

    $salt = $matches[2];

    $submittedPW = crypt($HTTP_SERVER_VARS['PHP_AUTH_PW'], $salt);

    if($submittedPW != $authPW)

        continue;



    break;

}



echo "You got in!"

?>


Here is my solution - works in MSIE and Mozilla.



I use http-authentication only for the first time user accesses his

private page; after valid username and password are provided, he is

recognized using his sessionID and ip ...

the reasons are following:

1) when users changes his password it is not required instantly

   (I find this quite comfortable)

2) auto-login function works fine (unless user click logout)



And here's how i works ...



The "trick" is to pass a temporary username+password to the browser.

(I call it "temporary" because no user account matching these

parameters is neccessary.)



The most essential thing is the following link on user's private page:



===

<?  $url = "http://".

        $username.     // see note 1

        ":".

        Session_ID().  // see note 2

        "@localhost/".PROJECT_NAME."/logout.phtml";

?>

<a href="<?=$url?>">logout</a>

===



1) we pass the actual username because MSIE uses this username as

   a "default pre-fill" for the login-window and some hash-string

   would confuse the users.

2) the temporary password is not too important, but there are

   two things we expect from it:

   a) we need to know this string in the logout.phtml script

   b) the string definetely should not match the user's password

      (otherwise user gets logged back instantly); using current

      Session_ID() we are pretty sure this won't happen



This link causes that the temporary login-params are available in

the logout.phtml script.

Using "www-authenticate" header in the logout.phtml script we force

the browser to accept our temporary login-params. (I suppose browser

actually repeats the request and the next time it checks

the login-params sent in the URL; but this is only my guess and

it is not important.)



The logout.phtml code:

===

<?  $query = "UPDATE users SET sessionID = NULL ".

        "WHERE sessionID = '".Session_ID()."'";

     $mysql->query($query);

     // because we (me :o) use the sessionID and the ip for

     // the identification we need to clean the sessionID; (I found it

     // a little bit easier to destroy the sessionID in the db than

     // unsetting the cookie and/or destroying+restarting

     // the current session)



     if($PHP_AUTH_PW != Session_ID()) {

        // keep asking for the login-params untill PHP_AUTH_PW returned

        // by the browser matches the current Session_ID() (which means

        // that the browser accepted the temporary login-params

        // we sent to it AND FORGOT THE REAL ONES)



        Header("HTTP/1.0 401 Unauthorized");

        Header("WWW-Authenticate: Basic realm=\"".PROJECT_NAME."\"");

    }

?>

<html>

    <head>

        <meta http-equiv="author" content="yaroukh at email dot cz">

        <title><?=PROJECT_NAME?></title>

        <link rel="stylesheet" href="style.css" type="text/css">

    </head>

    <body>

         <a href="http://localhost/<?=PROJECT_NAME?>/main.phtml">continue</a>

    </body>

</html>

===



About the "continue" link: the link is not too important, but using it

we can get rid off the temporary login-params which wouldn't look

too aesthetically in the address-bar. :o)


Here is a code for the public sites enabling both logout bottom and timeout using php+mysql. Working for both browsers.


The part "required" for each user protected page:





<?


function auth () {


        Header("WWW-Authenticate: Basic realm=\"ArmFN public site\"");


        Header("HTTP/1.0 401 Unauthorized");


        echo "You have to authentificate yourself first \n";


        exit;


}





mysql_connect("localhost","train","") or die("Unable to connect to SQL server"); 


mysql_select_db( "train") or die( "Unable to select database"); 





if(!isset($PHP_AUTH_USER)) {





$timeout = mktime(date(G),date(i)+10,0,date("m"),date("d"),date("Y"));


mysql_query("update users set login='$timeout' where id='$user' and pasw='$pass'") or die("k");





    auth();





            } else {





    $pass = $PHP_AUTH_PW;


    $user = $PHP_AUTH_USER;





$nowtime = mktime(date(G),date(i),0,date("m"),date("d"),date("Y"));


$quer2 = mysql_query("select * from users where id='$user' and pasw='$pass' and login > '$nowtime'") or die("kuk2");





    if (mysql_num_rows($quer2) == "0") {


$timeout = mktime(date(G),date(i)+10,0,date("m"),date("d"),date("Y"));


mysql_query("update users set login='$timeout' where id='$user' and pasw='$pass'") or die("k");





auth();


}


        }


?>





You can have a "logout" bottom with hidden $go="logout" form element and then have somewhere this part:





if ($do == "logout") {


mysql_connect("localhost","train","") or die("Unable to connect to SQL server"); 


mysql_select_db( "train") or die( "Unable to select database"); 


mysql_query("update users set login=0 where id='$PHP_AUTH_USER' and pasw='$PHP_AUTH_PW'") or die("k");


}