Questions about 'PHP_AUTH_USER'

[datactrl]

Hi, all

If I use my login page to ask the user name and password instead of using
header(), is that possible I can save the user name and password in
$_SERVER['PHP_AUTH_USER'] and $_SERVRER['PHP_AUTH_PW'] for the whole
session. Or I just save it in $_SESSION variable. And is that securable in a
general level?


Jack

[Colin McKinnon]

datactrl wrote:

> Hi, all
>
> If I use my login page to ask the user name and password instead of using
> header(), is that possible I can save the user name and password in
> $_SERVER['PHP_AUTH_USER'] and $_SERVRER['PHP_AUTH_PW'] for the whole
> session. Or I just save it in $_SESSION variable. And is that securable in
> a general level?
>

Even if you could set the SERVER variables they will get overwritten by the
next request from the browser (which doesn't know to send the parameters
nor what values to use since you are using a form to collect the data).

The session would be the obvious place to keep it, but storing the password
in the session gives no advantage but does provide another place for any
cracker to look in for authentication details after they've broken into
your system.

HTH

C.