PHP 标头身份验证奇怪的代码 - PHP header authentication strange code

PHP header authentication strange code

本文关键字：代码身份验证 PHP | 更新日期: 2023-09-27

我从 PHP.net 代码中复制了用于标头身份验证的代码

这是代码：

<?php
$valid_passwords = array ("Itay" => "1234", "beta" => "password");
$valid_users = array_keys($valid_passwords);
$user = $_SERVER['PHP_AUTH_USER'];
$pass = $_SERVER['PHP_AUTH_PW'];
$validated = (in_array($user, $valid_users)) && ($pass == $valid_passwords[$user]);
if (!$validated) {
  header('WWW-Authenticate: Basic realm="this is testing area. beta testers only!"');
  header('HTTP/1.0 401 Unauthorized');
  die ("Not authorized");
}
// If arrives here, is a valid user.
?>

现在，我的问题是为什么这行：

$validated = (in_array($user, $valid_users)) && ($pass == $valid_passwords[$user]);

代替

$validated = $pass == $valid_passwords[$user];

$validated = (in_array($user, $valid_users)) && ($pass == $valid_passwords[$user]);

此行检查该用户是否存在以及密码是否正确。

如果删除用户检查，则用户="不存在"和密码="将有效（当然，会有通知。

检查：

$pass = "";
$user = "any non existing"
$validated = ($pass == $valid_passwords[$user]); //here will be notice
var_dump($validated);