[SOLVED] user, session , security

[asmith]

when a user log in :

before i show him his logged page

$_SESSION[user] = "aaa";

 

and at all of user pages :

 

if ($_SESSION[user] != "aaa") {header("location: login.php");exit;}

 

1.is this way enough secure ?

i mean i have put a "aaa" variable  , isn't that unsafe ?

2.beside how can i use a changable variable for defining users ?

[trq]

Usually easiest to use booleens.

 

If user logged in successfully....

 

<?php

  session_start();
  $_SESSION['user_logged_in'] = true;

?>

 

Then a simple login check...

 

<?php

  session_start();
  if (isset($_SESSION['user_logged_in'])) {
    // user is logged in.
  }

?>

[asmith]

it has nothing to do with safety or security or anything ?

(as session is a server-side file , no need to worry about information in it ? )

[trq]

That is about as safe as sessions can be.

[asmith]

got it ! thanks