Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>There are basically two ways you can implement a login script in PHP:</p> <ol> <li>Using <a href="http://www.php.net/manual/en/features.sessions.php" rel="noreferrer">Sessions</a></li> <li>Using <a href="http://www.php.net/manual/en/features.cookies.php" rel="noreferrer">Cookies</a></li> </ol> <p>I'll try to explain both uses in a <strong>raw</strong> form below, so keep in mind there is a lot more to know about each of them.</p> <h1>Using Sessions</h1> <p>Making it simple, sessions are unique and lives as long as the page is open (or until it timeouts). If your browser is closed, the same happens to the session.</p> <h2>How to use it?</h2> <p>They are pretty simple to implement. First, make sure you start sessions at the beginning of each page:</p> <pre><code>&lt;?php session_start(); ?&gt; </code></pre> <p><em>Note: It's important that this call comes before of <strong>any page output</strong>, or it will result in an "headers already sent" error.</em></p> <p>Alright, now your session is up and running. What to do next? It's quite simple: user sends it's login/password through login form, and you validate it. If the login is valid, store it to the session:</p> <pre><code>if($validLoginCredentials){ $_SESSION['user_id'] = $id; $_SESSION['user_login'] = $login; $_SESSION['user_name'] = $name; } </code></pre> <p>or as an array (which I prefer):</p> <pre><code>if($validLoginCredentials){ $_SESSION['user'] = array( 'name' =&gt; $name, 'login' =&gt; 'login', 'whichever_more' =&gt; $informationYouNeedToStore ); } </code></pre> <p>Ok, now your user is logged in. So how can you know/check that? Just check if the session of an user exists.</p> <pre><code>if(isset($_SESSION['user_id'])){ // OR isset($_SESSION['user']), if array // Logged In }else{ // Not logged in :( } </code></pre> <p>Of course you could go further, and besides of checking if the session exists, search for the session-stored user ID in the database to validate the user. It all depends on the how much security you need. </p> <p>In the simplest application, there will never exist a $_SESSION['user'] unless you set it manually in the login action. So, simply checking for it's existence tells you whether the user is logged in or not.</p> <p>Loggin out: just destroy it. You could use</p> <pre><code>session_destroy(); </code></pre> <p>But keep in mind that this will destroy <strong>all sessions</strong> you have set up for that user. If you also used $_SESSION['foo'] and $_SESSION['bar'], those will be gone as well. In this case, just unset the specific session:</p> <pre><code>unset($_SESSION['user']); </code></pre> <p>And done! User is not logged in anymore! :)</p> <h1>Using Cookies</h1> <p>Cookies works somewhat alike sessions, except they are <strong>stored</strong> in the client browser and lasts as long as you tell them to. For instance, you were using cookies "as sessions" when you were setting them to expire at <em>$timeNow</em>. </p> <p>I usually don't like using cookies for simple logins as they require more advanced security checks. Since they are stored at users' browser, they can easily be manipulated and malicious users could <em>generate</em> false login information and log into your system.</p> <h2>How to use it?</h2> <p>Pretty much as you do with sessions. The difference is about setting/unsetting the cookie:</p> <pre><code>// To set a Cookie // You could use the array to store several user info in one cookie $user = array( 'id' =&gt; $id, 'name' =&gt; $name, 'login' =&gt; $login, ) setcookie("loginCredentials", $user, time() * 7200); // Expiring after 2 hours // Now to log off, just set the cookie to blank and as already expired setcookie("loginCredentials", "", time() - 3600); // "Expires" 1 hour ago </code></pre> <p>To check if a user is logged in, you can use the same example as of the session, but using a different variable: $_COOKIE</p> <pre><code>if(isset($_COOKIE['user']['id'] &amp;&amp; !empty(isset($_COOKIE['user']['id']))){ // Logged In }else{ // Not logged in :( } </code></pre> <p>Well, that's it. To remind you again, these are <strong><em>very simple</em></strong> login methods examples. You'll need to study a bit more about both methods and improve your code with some more layers of security checks depending on the security requirements of your application.</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload