I copied from PHP.net code for header authentication
Here is the code:
<?php
$valid_passwords = array ("Itay" => "1234", "beta" => "password");
$valid_users = array_keys($valid_passwords);
$user = $_SERVER['PHP_AUTH_USER'];
$pass = $_SERVER['PHP_AUTH_PW'];
$validated = (in_array($user, $valid_users)) && ($pass == $valid_passwords[$user]);
if (!$validated) {
header('WWW-Authenticate: Basic realm="this is testing area. beta testers only!"');
header('HTTP/1.0 401 Unauthorized');
die ("Not authorized");
}
// If arrives here, is a valid user.
?>
Now, my question is why does this line:
$validated = (in_array($user, $valid_users)) && ($pass == $valid_passwords[$user]);
is used instead of
$validated = $pass == $valid_passwords[$user];