Sessions - how do they work? - PHPBuilder Forums

Sessions - how do they work?

conjurer

I am trying to set up an area where our members log in and then they can do a directory search. I got a password and login thing working and I then test to make sure they are a valid user and set the username to the session valid user.

If they manage to login I then send them to search_form.php where they can enter some search criteria. The method is "post" on that form and the action takes them to a member_list.php page where the query is generated and results are displayed.

How do I ensure on the search_form.php and the member_list.php that I am still working with the same session user? Do I just need to do a test to see if $_SESSION['valid_user'] exists or is there something else to it?

The login form requires them to validate using the following code:

//connect to database
$conn=db_connect();

if ($username && $passwd)
{

  // they have just tried logging in
  login($username, $passwd, $conn);
   //returns true if their username and password match the database
  // if they are in the database register the user id
    $_SESSION['valid_user'] = $username;
}
else 
  exit ;

mark_kccs

Hi conjurer

As far as I’m aware each session has a unique id that is lost once the browser is closed. I see a small problem with $_SESSION['valid_user'] = $username;
as the value for $username will only be know to this page and you will have to pass it across to validate it. Why not set it to the session_id() and then use something like this in all your pages

<?php
session_start();
if ($_SESSION[‘valid_user’] == session_id()) {
?>
<html>

all html and php…

</html>
<?php
} else {
header('location:login.php');
}
?>

Hope this helps

conjurer

I must have confused you there. On the login page I check my database for the username and password they give me. Then if they give me a valid combination I then set the $Session[‘valid_user’] variable to match the username they logged in with.

It seems to carry that value to the other pages and "remember" their username.

On other pages if I echo $Session[‘valid_user’] ; it prints the name if they are logged in and errors out if they have not logged in.