note 16663 added to function.session-register

Hi all, I try to design a class SessionManager responsible for the managment of my user session. I have a login function which enable a user to login after sending his username and his password. I tried this code : function login($username,$password) { $requete = "SELECT password FROM administrateur WHERE user='$username'"; $exec = mysql_query($requete); if ($result = mysql_fetch_object($exec)) { if ($result->password == $password) { session_register("username"); } else { $this->destroy(); header("location: ../../listeDomaine.php"); } } else { $this->destroy(); header("location: ../../listeDomaine.php"); } } But the username is not registered to the session because I think it is a local variable ant it is not post by the browser. So my question is how can I register a variable in a function ? My second probleme is that is I use this function : function session_ok() { if (!session_is_registered("username")) { $this->destroy(); header("location: ../../listeDomaine.php"); } } in order to determine if the user is well logged to the session. I can bypass the protection by putting directly something like getLogin.php?username=toto into the url. Is there a way to protect my application using the session functions ? Thanks a lot -- http://www.php.net/manual/en/function.session-register.php http://master.php.net/manage/user-notes.php?action=edit+16663 http://master.php.net/manage/user-notes.php?action=delete+16663 http://master.php.net/manage/user-notes.php?action=reject+16663