title: php header() Authentication
body: <p>Can anyone tell me why this authentication won't work?</p>
  
  <p>This is a breakdown:</p>
  
  <p>1) I'm trying to create a simple authentication using WWW-Authenticate with the php header() function.<br>
  2) When I go to the page, the authentication box pops up like so:
  <a href="https://i.stack.imgur.com/2cZLY.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/2cZLY.jpg" alt="I receive this prompt when the page is loaded."></a> <br>
  3) If I remove the script (see script below), the page loads as expected.<br>4) No matter what password I put in or add/remove the Realm, Stale etc, nothing bites and the Authentication box just keeps looping when I click "Log In".</p>
  
  <pre><code>if( $_SERVER['PHP_AUTH_USER'] != NULL &amp;&amp; $_SERVER['PHP_AUTH_PW'] != NULL &amp;&amp; $_SERVER['PHP_AUTH_USER'] == ‘admin1’ &amp;&amp; $_SERVER['PHP_AUTH_PW'] == ‘pwd1’ ) {
     $_SESSION['login_flag'] = true;
    } else {
  header("WWW-Authenticate: Basic realm=\”Schoolroom\”, stale=FALSE");
      header("HTTP/1.0 401 Unauthorized");
      print "&lt;h1&gt;401 Unauthorized&lt;/h1&gt;";
      exit();
    }
  </code></pre>
  
  <p>Can anyone tell me what I am doing wrong? I've also tried in multiple browsers and various computers, same issue. </p>
  
  <p><strong>UPDATE: 10:44am PST, July 5 - This is where I am at so far with modified, updated and commented code:</strong></p>
  
  <pre><code> &lt;?php
  header('WWW-Authenticate: Basic realm="Secret page"');
  header('HTTP/1.0 401 Unauthorized');
  
  // Status flag:
  $LoginSuccessful = false;
  
  // Check username and password:
  if (isset($_SERVER['PHP_AUTH_USER']) &amp;&amp; isset($_SERVER['PHP_AUTH_PW'])){
  
  $Username = $_SERVER['PHP_AUTH_USER'];
  $Password = $_SERVER['PHP_AUTH_PW'];
  
  if ($Username == 'usrnm' &amp;&amp; $Password == 'pswrd') {
  $LoginSuccessful = true;
  }
  }
  
  // Login passed successful?
  if (!$LoginSuccessful){
  
  /*
  ** The user gets here if:
  **
  ** 1. The user entered incorrect login data (three times)
  ** --&gt; User will see the error message from below
  **
  ** 2. Or the user requested the page for the first time
  ** --&gt; Then the 401 headers apply and the "login box" will
  ** be shown
  */
  
  // The text inside the realm section will be visible for the
  // user in the login box
  //header('WWW-Authenticate: Basic realm="Secret page"');
  //header('HTTP/1.0 401 Unauthorized');
  
  print "Login failed!\n";
  
  }
  else {
  
  // The user entered the correct login data, put
  // your confidential data in here:
  
  print 'you reached the secret page!';
  }
  
  ?&gt;
  </code></pre>
  
  <p>However, the script <strong>does not</strong> prompt to login window but instead renders "Login Failed".</p>
  
  <p>We tested it with all available PHP versions 5.0, 5.1, 5.2, 5.3, 5.4, 5.5, 5.6, 7.0, 7.1, but to no avail. </p>