Keeping users logged in / maintaining user session

[floridadesigns]

I'm creating a site for a client, and wanted to know what the best (or the standard) way of securely maintaining a user's session is after they log in.

Most login systems have something like this, so I was wondering what my options are to keep a user securely logged in as they browse my site.

Thanks a lot, any advice would be greatly appreciated!

[Orangutang]

Hi, I'm a beginner myself but my post is relevant to your query. Hopefully it helps.

[Readie]

The most common method is to use a session. You can create the $_SESSION super-global array by calling the function

session_start();

at the top of your pages, before any output has been sent.

You can then asign values to $_SESSION like you would to any array, and these will persist through link clicks etc.

www.example.com/file_1.php

<?php

session_start();

$_SESSION['foo'] = 'bar';

?>

www.example.com/file_2.php

<?php

echo $_SESSION['foo'];

?>

[rocknbil]

An annotation, you need to execute session_start() at the top of every script accessing session variables. It starts sessions but is also the mechanism that re-connects with any previously started sessions.

The second bit of code there would fail with an undefined variable, because there is no session in the second script. Add session_start() right after <?php and all will be well. Readie knew that, just forgot it. :-)

Most often you'd just put it in the header file so it doesn't get forgotten.

[Matthew1980]

Hi all,

Most often you'd just put it in the header file so it doesn't get forgotten.

I thought that this was kinda the point of using include("someFile.php"); to save yourself from rewriting the same code over & over & over etc ;)

Cheers,
MRb

[impact]

Apart from what has already been said, each time your user visits a new page you can regenerate the session id and store in to database. That way, you are making session high jacking difficult.

You can also store the session value into a database.