Remove $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW']

unset($_SERVER['PHP_AUTH_USER']);
unset($_SERVER['PHP_AUTH_PW']);

unset does not work in this case. You have to send headers to reauth the user, so the remote browser know the credentials are no longer valid , but tat will be very confusing for the enduser

function authenticate() {
    header('WWW-Authenticate: Basic realm="Test Authentication System"');
    header('HTTP/1.0 401 Unauthorized');
    echo "You must enter a valid login ID and password to access this resource\n";
    exit;
}

Why do you want to unauth the user in that case?

why not use $_SESSION variables to authenticate, you can't unset $_SERVER variables.

Hello, guys.

unset does not work.

To hernst42, Reason what i unauth is when a user can access to admin pages  again he can get in there without id,password.

To nplib, this is for mobile site and some mobile browers do not accept session variables. $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_USER']  are OK on them.

Thanks,portal

thanks