&& and || are mixed up ?? :S

skibbli · 05-19-2010, 05:41 PM

PHP Code:


			
if ($_SERVER['PHP_AUTH_USER'] !== "username" && $_SERVER['PHP_AUTH_PW'] !== "password") {

    header('WWW-Authenticate: Basic realm="login"');

    header('HTTP/1.0 401 Unauthorized');

    echo '<h2>Unauthorized!</h2>';

    exit;

}

echo "you are now authenticated.";

the above code makes sense doesn't it? it really should work.

but upon further testing with that code above i have come to the conclusion that it will instead of requiring BOTH the username and password. it will only require one or the other...

HOWEVER, using "||" instead of "&&" will cause it to work the way i had originally intended it to work (requiring both fields to match using "&&" instead of one or the other)

PHP Code:


			
if ($_SERVER['PHP_AUTH_USER'] !== "username" || $_SERVER['PHP_AUTH_PW'] !== "password") {

    header('WWW-Authenticate: Basic realm="login"');

    header('HTTP/1.0 401 Unauthorized');

    echo '<h2>Unauthorized!</h2>';

    exit;

}

echo "you are now authenticated.";

can anyone tell me why this may be?
could i have a small error in my code?

Salathe · 05-19-2010, 09:38 PM

Consider the cases:

Code:

$_SERVER['PHP_AUTH_USER'] !== "username" && $_SERVER['PHP_AUTH_PW'] !== "password"
-----
Username valid,   password invalid: FALSE && TRUE   gives  Authenticated
Username invalid, password valid:   TRUE  && FALSE  gives  Authenticated
Username valid,   password valid:   FALSE && FALSE  gives  Unauthorized!
Username invalid, password invalid: TRUE  && TRUE   gives  Unauthorized!


$_SERVER['PHP_AUTH_USER'] !== "username" || $_SERVER['PHP_AUTH_PW'] !== "password"
-----
Username valid,   password invalid: FALSE || TRUE   gives  Unauthorized!
Username invalid, password valid:   TRUE  || FALSE  gives  Unauthorized!
Username valid,   password valid:   FALSE || FALSE  gives  Authenticated
Username invalid, password invalid: TRUE  || TRUE   gives  Unauthorized!

A perhaps clear option is to have the condition being not (username valid and password valid)...

PHP Code:


			
if ( ! ($_SERVER['PHP_AUTH_USER'] === "username" && $_SERVER['PHP_AUTH_PW'] === "password")) {

core1024 · 05-22-2010, 02:19 PM

Hello, skibbly!
The mistake here is that you thought "if username is wrong and password is wrong" instead of "either username or password is wrong" or even "if not username and password are correct". The logic is like in math - first multiply then add. Consider "true" as non-zero, "false" as zero, "not" or exclamation mark means reverse, "and" means multiply, "or" means add. So if in this case you've go wrong username (false/zero) and correct password (true/non-zero) - zero * non-zero equals zero i.e. you pass. In this case the only way to get non-zero is to have two non-zero values. When you add is something different - it is enough to have only one non-zero to get non-zero. I hope you get it ;)