Question

I am using php session for a basic login without encryption for my site. I want to prevent a user from directly accessing a php page by typing the url when he/she is not signed in. But this is not happening. I am using session_start(), initializing session variables and aslo unsetting and destroying sesssion during logout. Also if I type the link in a different browser the page is getting displayed.
I am not very well versed with php , only a beginner. I googled for such problem and found few alternatives as keeping all files in a seperate folder from the web root, using .htaccess etc. Can someone explain in simple terms what could be a good solution.thanks in advance.

Answer 1

There are lots of solutions, but basically you need to generate the page only if the session is valid. If not valid, shunt user to a non-access display. If you have this and it seems not to work, perhaps you should post some code.

• http://www.astahost.com/info.php/simple-user-validation-script_t14857.html
• http://www.puremango.co.uk/2004/12/php_pass_81