How to use form-based authentication

      <?php
require_once('model/database.php');
require_once('model/admin_db.php');

$email = '';
$password = '';    
if (isset($_SERVER['PHP_AUTH_USER']) && isset($_SERVER['PHP_AUTH_PW'])) {
    $email = $_SERVER['PHP_AUTH_USER'];
    $password = $_SERVER['PHP_AUTH_PW'];    
}

if (!is_valid_admin_login($email, $password)) {
    header('WWW-Authenticate: Basic realm="Admin"');
    header('HTTP/1.0 401 Unauthorized');
    include('unauthorized.php');
    exit();
}
?>
      

      <?php 
      require_once('util/secure_conn.php'); // require a secure connection
      ?>
      

      <?php 
      require_once('util/secure_conn.php'); // require a secure connection
      require_once('util/valid_admin.php'); // require a valid admin user
      ?>      
      

Description

• You can use a utility file like the valid_admin.php file to redirect to the controller if the user isn’t logged in as a valid administrator.
• The code at the top of the login page should force the page to use a secure connection.
• The code at the top of each protected page should force a secure connection. To do that, it can include a utility file that forces the connection.
• The code at the top of each protected page should also force a valid admin user. To do that, it can include a utility file like the valid_admin.php file on this page.