How to work with sessions and control php pages

mohsini

Hello Guys,

I just started learning php last week and on thing which I dont understand is how can i handle and maintain session in PHP. I used to program in ASP and the logic is you just declare ans start session in ur index page and the session is maintaines. But in PHP if i have 10 pages, i have to write <?php session_start ?> on every page.

Let me explain, I have a 2 php pages., login.php and mainsite.php.

Login.php is my first page. In this page i have written and started the session. Now if teh login is correct, I use query string ?contentbox=gallery;

So when the mainsite.php is called, it gets the URL variable and depending on the variable(contentbox) the page is displayed. SO now what i dont understand is, how to maintain and control the session.

Lets say if any users want to play, he can just type http://www.mysite.com/mainsite.php?contentbox=gallery

and the page will display as even in this form i have writted session_start, so how can i restrict the user not to manipulate with my pages.

Plz reply, I know it might be simple, but im just a beginner.

Thanks

leatherback

Hi,

You need to start a session on each page that you want the session to be available. This in independent of your login system. in other words: If you want to control access to a page, you need to define which anmd what a user is allowed to do:

<?php
session_start();

if($_SESSION['MyLoggedinVariable'] == true && $_SESSION['SomeRandomKey'] == 'SomeTrialVariable')
  {
  // allow access
  }
else
  {
  // enforce login
  }

I have for my sites an include file, in which I start the session, verify session variables, and generate a loggedin variable. In my pages I can use that variable to decide what a person is allowed to see.

messels

great tip. i've been wondering how far i can use the session variables to control the site on a macro level.

so, on that, when someone logins in to your sites, you not only pass the user session variable but also a permission-level session variable? cool.

so, if (!($SESSION['user'] && $SESSION['permissions']))
print ("whatever-the-hell-is-necessary");
[?]

how are you generating the permissions? is that stored in the db?

leatherback

In general PhP takes care of the administration of whatever is stored in your sessions.

I personally am paranoid, so I store not only the session ID, but also user ID, user IP, their browser and a random string which changes with each pageload. On my server I keep my own database table for this, although you could just keep it in the session alone. AFAIK sessions are pretty secure.