Posted by AlexVN on 11/01/06 21:52

On Nov 1, 9:09 pm, "Phil Latio" <phil.la...@f-in-stupid.co.uk> wrote:
> Found the below script in a book I am reading.
>
> However it seems to me to fatal flaw that if you run it but type in the
> wrong the details, you're basically buggered. As far as I can see, whatever
> is initially entered into PHP_AUTH_USER and PHP_AUTH_PW are stored and then
> compared against the database. However #10 simply looks for the presence of
> data in PHP_AUTH_USER and PHP_AUTH_PW, finds something and compares it
> again in a loop you cannot break out of.
>
> Can someone confirm what I am saying or have I missed something obvious.

Looks you are right. Please consider the examples on
http://www.zend.com/zend/tut/authentication.php?article=authentication
When user provided wrong credentials, the 401 error should be sent
again.

Sincerely,
Alexander
http://www.alexatnet.com/ - PHP/ZendFramework/Ajax blog

• Next in forum: Re: PHP and Outlook
• Prev in forum: Re: need help with dates
• Thread view: Re: Does this Auth script have an unwanted loop?

[Reply to this message]