Re: security checks with sessions...

On 5/15/02 12:38 PM, "Jas" jlgerfen@hotmail.com pressed the keys forming the message: > I am wondering if someone can help me understand a good way to use sessions > to check to see if a user has entered a user name and password before > allowing them to view the rest of the page. I need to have this check on > each page, just not sure how I can pass the sessions to each page, as of yet > I can get the variables I have registered to pass from the login form to the > login check, and from there it seems to drop the session variable I > registered. Any pointers would be great! > Thanks in advance, You need to use session_start(); on each page (in fact, it has to be the very first thing). That'll tell PHP to either look for an existing session, or to start a new one. To store variables for later use by the session, use $_SESSION["varname"]; Now, when you say, "I can get the variables I have registered to pass from the login form to the login check, and from there it seems to drop the session variable I registered," without looking at your code, it's tough to tell what's going on. I'm having a problem with Windows right now that is causing that same problem. Other problems would be: - Not using session_start() - Not storing the variables correctly for later retrieval (e.g. Using $_SESSION). - Not passing the session ID, either yourself or letting PHP do it. Check the manual for the section on sessions. It explains a lot. -- Ed Marczak marczak@usa.net P.S. Some of this assumes PHP v 4.10 or greater.