Sessions

NZ_Kiwi

Hi,

Would it be ok for me to set a code which confirmed your username and password and then started a session if all was ok then from there somehow show a page if a user was logged in but not if they were not! also be able to do a sql search and if the user had a level of 3 show more information!

Jona

[font=trebuchet ms]NZ_Kiwi, are you asking if sessions are secure?[/font]

NZ_Kiwi

Originally posted by Jona
[font=trebuchet ms]NZ_Kiwi, are you asking if sessions are secure?[/font]

well.... more if that it is a good way to do it

Jona

[font=trebuchet ms]As far as I know, it's how phpBB does it, this forum does it, I do it, and probably most others do too. I think it's a good place to start.[/font]

drawmack

actually this forum uses cookies, bbuserid and bbpassword to be specific. On top of that bbuserid holds the unique id of your record and bbpassword holds the md5 (I think) hash of your password.

Jona

Originally posted by drawmack
actually this forum uses cookies, bbuserid and bbpassword to be specific. On top of that bbuserid holds the unique id of your record and bbpassword holds the md5 (I think) hash of your password.

[font=trebuchet ms]You're right, it does. I didn't check, I assumed. It does, though, use sessions if you're not logged in. (Though you also don't have the features you would have if you were logged in, obviously.)[/font]

drawmack

Originally posted by Jona
[font=trebuchet ms]You're right, it does. I didn't check, I assumed. It does, though, use sessions if you're not logged in. (Though you also don't have the features you would have if you were logged in, obviously.)[/font]

I was playing around with crul today or I wouldn't have known myself.

NZ_Kiwi

Originally posted by Jona
[font=trebuchet ms]You're right, it does. I didn't check, I assumed. It does, though, use sessions if you're not logged in. (Though you also don't have the features you would have if you were logged in, obviously.)[/font]

So Cookies are best are they?

Jona

Originally posted by NZ_Kiwi
So Cookies are best are they?

[font=trebuchet ms]Well, if you're going to only need a username/pass, yes. Sessions are basically cookies, only they're more temporary. Use sessions if you need to use lots of cookies.[/font]

drawmack

Rule of Thumb
If you want the user to be able to close their browser, shut down their computer, go to bed, wake up the next day, come back to the site and have the information remembered then use cookies.

If you want the information to be forgotten as soon as they close their browser use sessions.

For example:
I may wany my forum to remember the last thread a person viewed as long as their are on my site. That way I can offer them a browse from last viewed thread button. However, if they go away for a while I don't want that option anymore cause a lot of threads could have had posts in that time. So for this I would use a session.

On the other hand I could want to remember the last time they stopped by so I can create a display posts since last visit page. In this case I would use a cookie.

Understand?