User login or not?

How would I know?

[kenchix1]

I have this opensource software where user can login and post items for sale. I wanted to add my own modules but I don't know how to determine if a user is login. What I'm trying to add is a module where users can upload images of the items. I'm done with collecting the URL and displaying it, but I don't know how to check if the user who will add the picture on a certain item had login or not as well as making it safe that it is the owner of the item who's adding an image.

Thanks in advance.

[roldar]

To know if a user is logged in:

I always create a session. In this session I make a note of their login, date logged in, and their IP address.

Whenever they go to a new page or do anything, I check to be sure the first 3 blocks of their IP address match that which was put in the session when they logged in. The reason I don't go for an exact match is because some people whose ISP's have dynamic IP allocation will change the last block every time they go to a new page.

There are various other bits of information you can gather using $_SERVER[] variables that you can then check against them later on, in order to prevent session hijacking.

[kenchix1]

Thank you very much for your suggestion sir, it is informative, but I am really new in PHP and I don't know how to put it in code. Im just looking for a very simple routine that will check the user if he is logged in or not.

Thanks. :)

[roldar]

Well here's what I typically do in a very basic situation.

User enters their username and password, and you check it against that you have on file. If they both match:

-----
<?php
session_start();
$_SESSION['login']="yes";
$_SESSION['user_id']= (enter the unique user id which matches the username/pw combo they entered and you validated);
?>
-----

Then, on every page they would go to while logged in (your registered user only parts of the site) you would have:

-----
<?php
session_start();
if(@$_SESSION['login']!= "yes")
{
exit();
}
?>

Then when you want to update or insert something that they are creating/uploading/etc. you would get their user_id from the @$_SESSION['user_id'] variable, so you can later determine who that thing belongs to.

-----------

This is very basic, and would probably work if you're not doing anything sensitive (credit card #'s, etc). I generally like to insert their IP address into the session, then check against it to be sure they haven't been hijacked.

[kenchix1]

Thanks! you're very kind.

BTW, I tested it on a separate modules and it worked. But when I use the checking on the the opensource software that I am using, it doesn't seem to use session. I saw something like "setcookie" command and cannot find any module that uses $_session command.

This is hopeless.

[roldar]

I'm afraid I don't have any experience with traditional cookies.

From what I understand, sessions will work even if a user has cookies turned of. This is why I went that route rather than mess with cookies.

The difference between a cookie and a session is that a cookie is stored on the user's computer, while a session is all maintained on the server. Thus, if a user clears his cookies or has them off, the site won't work properly for them.

[kenchix1]

Thanks, I really appreciate your help sir.

Now that I cannot find any solution to find out if a user is login or not, it seems I have to scrap this module that I'm going to add because it is not safe even if I ask for the user's Key ID.

Noah's Classified code is very hard to understand.

[kenchix1]

I got it! it uses a session identifier using the cookies. :)