如何在PHP中使用基本身份验证连接SQL查询

Question

I want to connect my basic authorization with my MySQL database. Actually, I am developing a login REST API in PHP. Currently, I have hard coded my username and password in the PHP Authorization script but I want to connect to MySQL and validate the username and password with my database with basic authorization.

Here's my code:

<?php 
// User name and password for authentication 

$username = 'admin'; 
$password = 'password'; 

if (!isset($_SERVER['PHP_AUTH_USER']) || !isset($_SERVER['PHP_AUTH_PW']) || 
   ($_SERVER['PHP_AUTH_USER'] != $username) || ($_SERVER['PHP_AUTH_PW'] != $password)) { 
    // The user name/password are incorrect so send the authentication headers 
    header('HTTP/1.1 401 Unauthorized'); 
    header('WWW-Authenticate: Basic realm="Guitar Wars"'); 
    exit('<h2>Guitar Wars</h2>Sorry, you must enter a valid user name and 
          password to access this page.'); 
} 
?> 

And I would like to embed a query like this:

$query = mysql_query("SELECT username FROM login WHERE username='$username' and password='$password'");

Answer 1

Warning mysql_query, mysql_fetch_array,mysql_connect etc.. extensions were deprecated in PHP 5.5.0, and it was removed in PHP 7.0.0. Instead, the MySQLi or PDO_MySQL extension should be used.

Mysqli prepared statement

1) First connect the database and query the database with user given username and password finally based on row count you can know user is valid or not .

        //db connection

        $servername = "localhost";  //host name

        $username = "username"; //username

        $password = "password"; //password

        $mysql_database = "dbname"; //database name

    //mysqli prepared statement 

        $conn = mysqli_connect($servername, $username, $password) or die("Connection failed: " . mysqli_connect_error());

       mysqli_select_db($conn,$mysql_database) or die("Opps some thing went wrong");

        $stmt = $conn->prepare("SELECT * FROM $tbl_name WHERE username=? and password=? ");

        $stmt->bind_param('ss',$myusername,$mypassword);

        The argument may be one of four types:

        //i - integer
        ///d - double
        //s - string
        //b - BLOB
        //change it by respectively 

        $stmt->execute();
        $get_result =$stmt->get_result();

        $row_count= $get_result->num_rows;

        if($row_count>0)
        {
           echo "valid user ";
        }
        else
        {
          echo "not valid user";

        }