[SOLVED] Checking login info?

[Norsk.Firefox]

Hello,

Read some place that checking the login info with the mysql table every time the person reloads the page is a waste of resources. So, the question I'm asking you? How would you check if a person is logged in, and stays logged in? (Based on sessions and mysql).

[revraz]

If you use sessions, you don't have to check the DB each time, just set a variable and check that instead.

 

If you don't want the session to time out, you can also use a cookie.

[Norsk.Firefox]

Hm .. Ok, but sessions is saved on the server, and cookies at the users computer. So cookies are easy to manipulate.

 

But check it against a variable?

 

Any code example? 

[revraz]

For a session?

 

When they log in set $_SESSION['loggedin']= true

 

To check it

 

if ($_SESSION['loggedin'] == true) {

//logged in

}

else {

//not logged in

}

[rab]

<?php
session_start();

$loggedIn = False;

// Either not logged in or session expired 
if( empty($_SESSION['user']) ) {
    if( isset($_COOKIE['user']) ) {
        $data = unserialize($_COOKIE['user']);
        // Assumes loginUser escapes variables...
        if( loginUser($data['user'],$data['pass']) ) {
            $_SESSION['user'] = $data;
            // Now logged in
            $loggedIn = True;
         }
     }
} else $loggedIn = True;
?>

 

When they actually do login, assign $_COOKIE['user'] serialized data of the $_SESSOION['user']. Users can modify cookies, but with the login check you can see if the cookie is valid or not.

 

[Stephen68]

you do your DB check and if the user is able to log in just set a session to their session id

 

$sessionID = SESSION_ID();

$_SESSION['sid'] = $sessionID."staff";

 

then check on the top of each page that you want protected by checking that value

 

session_start();

        $sessionID = SESSION_ID();

    if ($_SESSION['sid'] != $sessionID."staff") {

    header("Location: http://www.yoururl.com");

}

 

or something like that, code above is from the top of my head but you should get the meaning

Hope it was some help

 

Stephen

 

 

 

 

[Norsk.Firefox]

hehe, tanks all

 

Think I'm gonna go for that solution when viewing pages, but when their editing their profile and things like that I'm still gonna check.. (?)

[revraz]

Especially if they edit their profile.  You want to make sure they are in fact editing their own and have no way to edit someone elses.

 

I just did this today on one of my pages, and it was a bit of a challenge to make sure they are only allowed to edit their own profile.  Takes a little bit of thinking and logic.

[Norsk.Firefox]

Thanks