check if user is logged in or not

[Lotta]

I wonder if this check is enough to see if a user is logged in or not.

Global variables, declared at logged in

$Username;

$Password;

$User_ID;

First check so all sessions is registered

Then check so the session variables (global) are in the database

If session is registered and the session variables are in the database the user is logged in.

if ( (session_is_registered('Username')) AND (session_is_registered('Password')) AND (session_is_registered('User_ID')) ){
	 $logQ = mysql_query("SELECT COUNT(User_ID) FROM User_Tbl WHERE User_ID = '$User_ID' AND Username ='$Username' AND Password ='$Password' ");
	 if ( mysql_result($logQ,0,0) == 1) {
	 		$logged_in = true;
	 } else {
	 	 $logged_in = false;
	 }
}

/Charlotte

[jpmoriarty]

surely though you'd only register the session variables on a successful login, so you shouldnt need to recheck the database to see if they're a valid user, cos if they werent then the session variables wouldnt have been registered. No?

[Lotta]

Yes, that’s right.

The reason I did that extra check is because I thought it may be possible for a malicious user or someone else, to register a session with a null value? But maybe it isn’t?

[jpmoriarty]

i think they could only do that if they had write access to your ftp, and your problems would be bigger then.