Well, there are many many ways to secure your site’s pages. We could make many suggestions, but, scottlpool’s suggestion is the simplest and easy and fast to implement.
So, first, to explain session variables, they are basically, just a PHP variable. But, they can be passed from page to page. In normal PHP, you create a variable by assigning a value to them. Like $var_name=“value”;
This is simple and everyone understands it. Now, a “SESSION” variable is slightly different. On every page that uses them, you start a browser session. This session runs into every page that this current page calls. On each page, you tell it to use the session. Then, the variables are used with this assignment $_SESSION[“var_name”]=“value”; This allows you to pass variables from page to page.
How does this help you? Well, when a user logs in, you show a login page. You do not care who sees that page and so it does not need to be secured. Your login page calls your PHP script and if they pass validation of the passwords, you start a session and set a value to say they are okay. Then, every page on the site has code at the beginning of the code that checks for this session variable. If not valid, it goes to a NOT-ALLOWED-ACCESS page. Easy to do.
So, step by step…
At the top of EVERY page add this:
[php]
<?PHP
session_start();
?>
[/php]
You can add the one line to your existing PHP code, but, it MUST be the first command on every page in your PHP sections of code.
Next, in your code where you validate the user’s ID and password, if they pass, you assign a session variable. BEFORE the testing you set this session variable to null to make sure it is not passed to the other pages without being check first. Something like this:
[php]
<?PHP
// Before testing the user ID and password
$_SESSION["user_logged_in"] = "";
// If the user ID/password check is valid, add this just before redirection to the user's page
$_SESSION["user_logged_in"] = "yes";
?>
[/php]
Note: I made up the variable names and values, pick your own…
Now, that session variable stays active until you time out your page or close the browser.
So, all following pages have it to use. So, after your log in page sends the user to the link.php page, or where you want them to be, the frist part of that page tests to see if they are logged in. Like:
[php]
<?PHP
if ( $_SESSION["user_logged_in"] != "yes" ) { header("Location: noaccess.html"); }
?>
[/php]
Note: what this does is if the user is NOT logged in, it sends the user to another page I called noaccess.html. In that page, you would have a warning that they are not allowed here. And, maybe give them a link back to the login page.
What all this will do is lock people out of the link.php page. If you go to that page directly, then the session variable “user_logged_in” would NOT be set and therefore would then ship you off to the no-access warning page.
Hope that all makes sense. Good luck…
