Coupling Authentication with sessions

[AriGold]

Correct me if I am wrong on how I think I should go about doing this, but if I am right, help!!! Thanks in advance:

I am building a MySQL database with a PHP based front-end application that will allow for form based queries, addition/deletion of entries, etc.... All of that is fine. However, I need to implement an authentication component, which I am using PEAR:Auth. Furthermore, I need security on each page that you can navigate to, not just the main page, so that people cannot just type in the URL to bypass the login page. I assume sessions will handle this, and I am just looking for some tips or basic tutorials I can go to that will show me to to create a session, associate it with the logged in (or about to log in) user for a certain duration as they navigate about the site. Thanks a lot!

[adam291086]

well for php sessions google it.

 

php.net - the php bible

 

or

 

http://www.w3schools.com/php/php_sessions.asp or use the free book by thorpe http://hudzilla.org/phpwiki/index.php?title=Main_Page

 

[AriGold]

I did find some Google results, but they were related to establishing sessions for general web browsing; I need something that will establish a session that is user specific, then for the page to load, a session must have been established. Sorry if I'm not explaining clearly what I am looking for.

[revraz]

You either didn't use the correct search critieria or you don't know how sessions work.

 

google "session tutorial php" and you'll find some good tutorials.

 

one for example, http://www.htmlgoodies.com/beyond/php/article.php/3472581

[adam291086]

well when you verify a user details are correct and got a result then set the session.

 

$_SESSION['id']=$id;

 

How are you verifying a user is authenticated?

[AriGold]

well when you verify a user details are correct and got a result then set the session.

 

$_SESSION['id']=$id;

 

How are you verifying a user is authenticated?

 

All that does is establish a session for someone viewing that particular page. I might look to PEAR's Authentication package, but it's just as much work sometimes trying to use other code and understand it than writing your own.

[revraz]

Maybe if you explain what your goal is, we can help you better.

 

The $_SESSION variable is carried across every page on your site.

 

well when you verify a user details are correct and got a result then set the session.

 

$_SESSION['id']=$id;

 

How are you verifying a user is authenticated?

 

All that does is establish a session for someone viewing that particular page. I might look to PEAR's Authentication package, but it's just as much work sometimes trying to use other code and understand it than writing your own.

[AntiScourge]

I'm assuming you know how to do these first parts..

 

create your login form, when they click login have it POST to some kind of authentication page.

 

The page will query the server for a username or password match.. then you use the following

 

if (username and password are correct) {
  $_SESSION['UserAuthenticated'] = $username;
} else {
  $_SESSION['UserAuthenticated'] = "";
}

 

Then at the top of every page that requires authentication

if ($_SESSION['UserAuthenticated'] == "") {
  // Redirect user to login page
}

 

Also, besure to have session_start(); at the top of every page.

 

 

*EDIT*  Here's a decent tutorial

http://www.php-mysql-tutorial.com/user-authentication/basic-authentication.php