Software Engineering Stack Exchange is a question and answer site for professionals, academics, and students working within the systems development life cycle. It only takes a minute to sign up.
Sign up to join this community
What would be the advantages of using PHP_AUTH_USER and PHP_AUTH_PW instead of the verifying the credentials under method - post .
Why i should use:
$_SERVER["PHP_AUTH_USER"]; and $_SERVER["PHP_AUTH_PW"]
instead of
$_POST["user"]; and $_POST["pass"];
what actual difference does it make ?
what are the advantages and disadvantages of both techniques ?
which one is more vulnerable ?
You want to know the advantages, so here goes: PHP_AUTH_USER is an interface to HTTP Basic Authentication, which is already implemented at protocol level.
This allows a looser coupling between modules (since Basic Auth is a common standard, the modules using authentication needn't know each other), and you can have one authentication system leveraging HTTP Basic Auth, and thus forwarding information to other modules.
It also allows you not to implement authentication at all and rely instead on the server's - e.g. with Apache's .htaccess/htpasswd.
Of course, in this latter case, things like password recovery and editing become proportionately more difficult, and in some setups, impossible unless you get a sysadmin to do it for you.
By the same token, methods using forms and _POST, possibly through AJAX, are often more portable between platforms (suppose you have a CGI configuration that doesn't support PHP_AUTH_*?), and allow more/easier customizability both in behaviour (e.g. logout, password caching) and interface (basic auth is done by the browser, and you usually get a standard browser dialog asking username and password, which might "clash" with your interface).
