Well you can't really use HTTP authentication, as that will take a lot of manual updating. Basically, what I see you looking at is a few tables to track all of this:
Table Listing
users
- userID int(11) NOT NULL AUTOINCREMENT [Primary Key]
- username varchar(32) NOT NULL
- password varchar(255) NOT NULL
- emailAddress smalltext NOT NULL
sessions
- sessID varchar(255) NOT NULL [Primary Key]
- userID int(11) NOT NULL [Foreign Key to users.userID]
- variable varchar(255) NOT NULL
- value varchar(255) NOT NULL
log_visits
- visitID int(11) NOT NULL [Primary Key]
- userID int(11) NOT NULL [Foreign Key to users.userID]
- timeIn TIMESTAMP NOT NULL
Basically, the way it would work is something like:
1.) User registers, and their information is stored in the "users" table.
2.) User then uses the previously made credentials to log in:
2a.) Username is looked up in users table
2b.) Passwords are checked and verified to be correct
2c.) User has session information validated for them
3.) Session table is updated with information and the PHP Session Identifier
4.) log_vists table is updated so that the it's logged that the user visited on XX day.
5.) User logs out:
5a.) Session table is cleared of all data pertaining to that sessionID
That's basically it. Now, depending upon how secure you want the application, you can either implement a Database Session scheme (as I proposed here) or just use the typical file session scheme (which is PHPs default). The database provides more protection, but also takes more effort to implement.
