login questions

[makka]

hello well i have the hard part out of the way which is the registration and the cheeking if the username and password is correct now i would like some advice witch would you use for the login a sesion or a cookie? and if i use a cookie should i implode it?? also how would i check if there logged in on every page they go to?

[pocobueno1388]

I would use a session. So when they log in you need to register there ID as a session, then on every page that login is required, check if that session exists. If it doesn't...then they are not logged in.

[makka]

true but what about exploding and imploding things?

thats what this login uses that i saw what is the advantage of it? and the advantages of sessions?

[pocobueno1388]

You don't need to do any imploding or exploding when you register the session....I'm not sure what your trying to get at.

[OilSheikh]

Spelling probs 

 

Anyway, yeah, use Sessions.

 

It's gonna look like

 

if(!session_is_registered(usern))
{
header("location:home.php");
}

 

To log out, destroy the session

 

 

[trq]

Spelling probs 

 

Anyway, yeah, use Sessions.

 

It's gonna look like

 

if(!session_is_registered(usern))
{
header("location:home.php");
}

 

To log out, destroy the session

 

 

 

session_is_registered has long been depricated and should NOT be used. Just use...

 

<?php
if (isset($_SESSION['loggedin'])) {
  // loged in
}
?>

[makka]

hay dude could i save info onto a session and it will be secure and is setting into in a session just like using a cookie??

[The Little Guy]

Here is a little portion of my login page, I use sessions:

<?php
include'includes/includes.php'; //Include the database connections, and start session
$email = addslashes($_POST['email']);       //Get email input
$pass = addslashes($_POST['password']); //Get password input
$sql = mysqli_query($db,"SELECT * FROM users WHERE email = '$email' AND password = PASSWORD('$pass')")or die(mysql_error());//Check if user exists
$row = mysqli_fetch_array($sql); //find if any rows were returned
if($row){ //if there is a row, make some session variables
	$_SESSION['id'] = $row['id'];
	$_SESSION['first'] = $row['fname'];
	$_SESSION['last'] = $row['lname'];
	$_SESSION['email'] = $row['email'];
	$_SESSION['logged'] = TRUE; // This is to check if they are logged in or not
	header("Location: users.php"); // Redirect to the users page
	exit;
}else{ // if there is no row, don't set the sessions
	$_SESSION['logged'] = FALSE; // This is to check if they are logged in or not
	header("Location: index.php"); // Redirect to the loginpage/homepage
	exit;
}
?>

 

after that, on all your pages where the user must be logged in, do this:

 

<?php
include'includes/includes.php'; //Include the database connections, and start session
if(!$_SESSION['logged']){ // If $_SESSION['logged'] equals false redirect the user to a home/login page
	header("Location: index.php");
	exit;
}
?>