[RESOLVED] Help with Making A Secure Login

PPowerHouseK

Hello all,

I am very new to php, I just started learning is this week. I need to make a secure login, which I thought I was close to doing, however it is not working out. I have attemtped to use cookies for authentication, but that ended up being too confusing, since it would not read the cookie input properly. So I decided to switch to sessions and I haven't had much more luck.
Here is what I have after the login info is accepted:

$_SESSION['logged_in'] = true;

Here is the page it sends you to that should check if you are logged in.

<?php

if (!isset($_SESSION['logged_in']))
	{
		echo"failed";
		header("Location: fail.html");
	}
 else
	{
		echo("loaded<br>");


}


?>
<html>
<head>
<Title>Control Panel
</Title>
</head>
<body>
This is my control panel <BR>

test<br>
</body>
</html>

It sends me to the fail.html whether or not I go directly to index.php or use the login process. Any help would be much appreciate. I am new so please be polite.

dagon

you need to put session_start(); on any page you want to use sessions above the start of the code that uses $_SESSIONS

PPowerHouseK

Thanks that worked for login!
How would I set the Session Id as a variable so that I don't have to check each specific user on every page? I tried the following but it just doesn't set the variable, it just uses $username itself.

$_SESSION["logged_in" . $username] = true;

and

$_SESSION["logged_in_$username"] = true;

So which would be the proper way?

dagon

each session is already user unique

PPowerHouseK

Is this if statement too general then?
Because it will allow me to view another users page as well.
If I login as user 1 i can go into user 2's secure page and visa versa

if (!isset($_SESSION['logged_in']))
	{
		echo"failed";
		header("Location: fail.html");
	}
 else
	{
		echo("loaded<br>");


}

dagon

$_SESSION['username'] =$username;

PPowerHouseK

Where do I put that? In place of the initial $Session or on the page that checks it?

dagon

$_SESSION is an array you can store many values;logged in state, user id, user level ....

for user name populate when logged in, use it to check access on various pages.

PPowerHouseK

Thank you very much, you can mark this solved.

bradgrafelman

PPowerHouseK;10976625 wrote:
Thank you very much, you can mark this solved.

You can actually do that yourself (since you created this thread) by using the link on the Thread Tools menu above.