Hey. I just got back from lunch, won't be able to help much for at least 30 minutes, have an email transfer to cpmplete and a hosting account to set up
So, assuming one follows good security practices and trusts the PHP session security, one should do, starting each request (usually on its own file) something like
if (!$_SESSION['valid']) {
if(validate_user($_SESSION['user'],$_SESSION['pwd'])) {
$_SESSION['valid'] = true; //Don't forget to SQL sanitize me if validation's against a DB
} else {
die("You are not authorized"); //Saner to redirect to login page or whatever
}
}
yeah, what @TheUnhandledException said. There's nothing wrong with populating the session with some user metadata. Just don't put the password in there.
$q="SELECT * FROM users WHERE id=".intval($_SESSION['logged_in_user']
@Moshe Here's what I'd do. I'd have a function to fetch the user from the database and store it in a global somewhere, and a function to check permissions
So for example:
function loadUser()
{
global $system;
if(!is_set($system['user']))
// load the user from the database and store into $system['user']
}
under $system I usually have things like the MySQL database link, open file handles, logged in user, information about the request, etc. Anything the entire system will need.
@Moshe You shouldn't actually die() in production code, you should either redirect to an error page or have an error handler that would log the errors and display a fancy page to the user
