PHP Sessions and Authentications

Sessions with Authentications

In this example, an user logs in and sets a "logged in" state. The state knows the logged in user's details:

You can test the session by logging in with the admin, which is provided right above this text.

Protecting a Page

When an user hasn't met the requirements to go to a page, you can set a different one for them:

If the user is not logged in, they will be redirected into the log in page. If they are logged in, the can go to that page - whatever it might be, like an admin dashboard.

Logging Out of Account

When an user has logged in and set a session for it, its time to log out and destroy the session:

The "session_unset()" is there, because to break all the username session variables for instance (if the login was set like this -> "$_SESSION['username']"). The "session_destroy()" simply deletes the session completely.

Real login Session Example

Here's a complete instance of the logging and logging out system:

Its a system used in alot of web applications, which works well for security.

Security Tips

Here are a couple of guides:

The first one is mandatory to use, but the second one is also to prevent the attacks mentioned.