Secure logon to a site with php

Anon

I'm learning php, so please hang in there even if this questions seems elementary to you!

I have put together several pages to construct a forum, with one page to list subjects and another to display threads, another to search etc. At the moment, when a user logs in I pass their id with the URL as they move screens so they don't have to log in all the time. Trouble is, anyone can type "http://www.myforum.co.uk?id=50" and so become that user!

I know I can write a cookie to the client pc when they register, thereby uniquely identifying them. However, what about someone who has cookies disabled, or moves to another pc on another site? If they log in then I could write another cookie to their new machine, I guess.

What I'm after is a way to preserve a session on a screen by screen basis. Can this be done without relying on cookies? e.g. the user logs in when they arrive but then don't have to until they leave the site, without resorting to the "pass the id with the URL" flawed solution I described above.

I'm just getting into this side of PHP, so sorry that my ideas are muddled. I'd be very grateful to anyone who can point me in the right direction to achieve a secure application that doesn't bug users for passwords the whole time.

Thanks for listening!

Anon

One way is to set a session variable when they log in. Then have a script which checks for this session variable and exits if its empty. This file can be included at the top of any 'secure pages'
Hope this is helpful

christt

Sessions is the answere.

Anon

don't be so fast to discount cookies. they're pretty handy and the sessions lib uses them as it's first choice for session tracking anyway!

i would suggest that rather than write yr own session handler from scratch you should look at existing login libs like php secure pages or php_lib_login. easy to implement and fully featured.

Anon

Okay, thanks for replying, guys.

I am going to explore php sessions fully and implement a solution incorporating them.

frymaster: I didn't mean to discount cookies. I may well use them to recognise returning users and then combine this with kicking off a session. However, I didn't just want to rely on this method as sometimes a browser disables cookies.

I saw a good article at o'reilly's onlamp site on php sessions. It can be found here:

http://www.onlamp.com/pub/a/php/2001/04/26/sessions.html

and part two here:

http://www.onlamp.com/pub/a/php/2001/05/10/sessions.html

Now I just need to find the time to write this stuff!!!

Thanks for all your input..........