Question

i am building a php based website but now i need to give user a session, i.e the user can log in to website and have his session. after he should signout. how can i achieve this.?

Answer 1

You could have a $_SESSION[“auth”] = true once the user logs in and the script which verifies the password should usually set the above session variable . then redirect to a restricted-to-members page like dashboard.php or photos.php using header(). Once the user logs out you should use session_destroy() function. Also its safer to have a session_regenerate_id(true) on every page so the session id cookie regenerated to prevent session hijacking.

<?php
session_start();//start session
session_regenerate_id(true); 
if($_SESSION["auth"] != true) {
header("Location: login.php"); // redirects to login if user is not logged in already
}
else {
//has access
if(!isset($_SESSION["timeout"])) {
$_SESSION["timeout"] = time();
}
else if(isset($_SESSION["time"])) {
if($_SESSION["timeout"] - time() == 1800) {
header("Location: login.php");//timeout incase no activity for 30min , 30min = 1800seconds

}

}

}

?>