Http URL protection works in localhost but fails on the server - php

Question

Am using this code for authenticating my URL.
Its working fine in my localhost but when I load onto the server(goDaddy), its repeatedly asking for the username and password.
I wanna take control of those username and password fields and connect them to my database.
For that am using code like this:
$conid = mysql_connect("localhost", "root", "");
if(!$conid) {
die("sorry unable to establish a connection".mysql_error());
}
echo "connected succesfully<br>";
mysql_select_db("passurl", $conid);
$rr = mysql_query("select password from validate where username='$user' ");
while($row = mysql_fetch_array($rr)) {
$x = $row['password'];
}
if($x == $password) {
//take into the website
}
so when the username & password are entered by user, on successful authentication it takes into that page.
Am using PHP-MYSQL, as I've preliminary knowledge in it, am newbie to programming.
kindly help me in fixing the above two issues with the suitable tested code.
Edit:
Issue one is working locally and am using the same code as provided in the link. Issue two is am trying to retrieve those username and password fields from my local database so as login can be granted, on my localhost(if it works on later stage I'll take the database to online).
Edit-2:
ty.php contains code like
<?php
$auth_realm = 'Access restricted';
require_once 'auth.php';
echo "You've logged in as {$_SESSION['username']}<br>";
echo '<p>LogOut</p>'
?>
<center><h1>now you see the protected content</h1></center>
and auth.php contains
<?php
$_user_ = 'test';
$_password_ = 'test';
session_start();
$url_action = (empty($_REQUEST['action'])) ? 'logIn' : $_REQUEST['action'];
$auth_realm = (isset($auth_realm)) ? $auth_realm : '';
if (isset($url_action)) {
if (is_callable($url_action)) {
call_user_func($url_action);
} else {
echo 'Function does not exist, request terminated';
};
};
function logIn() {
global $auth_realm;
if (!isset($_SESSION['username'])) {
if (!isset($_SESSION['login'])) {
$_SESSION['login'] = TRUE;
header('WWW-Authenticate: Basic realm="'.$auth_realm.'"');
header('HTTP/1.0 401 Unauthorized');
echo 'You must enter a valid login and password';
echo '<p>Try again</p>';
exit;
} else {
$user = isset($_SERVER['PHP_AUTH_USER']) ? $_SERVER['PHP_AUTH_USER'] : '';
$password = isset($_SERVER['PHP_AUTH_PW']) ? $_SERVER['PHP_AUTH_PW'] : '';
$result = authenticate($user, $password);
if ($result == 0) {
$_SESSION['username'] = $user;
} else {
session_unset($_SESSION['login']);
errMes($result);
echo '<p>Try again</p>';
exit;
};
};
};
}
function authenticate($user, $password) {
global $_user_;
global $_password_;
if (($user == $_user_)&&($password == $_password_)) { return 0; }
else { return 1; };
}
function errMes($errno) {
switch ($errno) {
case 0:
break;
case 1:
echo 'The username or password you entered is incorrect';
break;
default:
echo 'Unknown error';
};
}
function logOut() {
session_destroy();
if (isset($_SESSION['username'])) {
session_unset($_SESSION['username']);
echo "You've successfully logged out<br>";
echo '<p>LogIn</p>';
} else {
header("Location: ?action=logIn", TRUE, 301);
};
if (isset($_SESSION['login'])) { session_unset($_SESSION['login']); };
exit;
}
?>
so once we hit ty.php it asks for username and password and on successful validation it shows the protected down. All this is working fine in localhost but its not working on the server.
Can someone pls help me out of this
Thanks in advance :)

Answer 1

You need to create a database username and password on your goDaddy hosting service, root and empty password can't get you through. The root is the default username for your local server and you didn't set any password for it, hence "" works for you as password. You must set up a username and a password on your remote server for it to work.
mysql_connect("your-host-server", "a-username", "a-secret-password"); // Password can't be empty and username can't be root, hope you understand

Answer 2

You are looping over the paswords, but only checking a single value after your loop.
Your code is:
while($row = mysql_fetch_array($rr)) {
$x = $row['password'];
}
if($x == $password) {
//take into the website
}
It should be:
while($row = mysql_fetch_array($rr)) {
if ($password == $row['password']) {
// take into the website
}
}