Question

I created a system that uses username/password login system with with ‘phpass’ class to store hashes and check passwords when user logs in.

I also use AJAX to load user information (that can only be retrieved if user is logged) with javascript.

My question is, should I check for user’s authentication in every page and in every file that returns AJAX values or just create a ‘connection’ entry in MySQL database.

Is it wrong to use ‘phpass’ functions in every page and request because of performance or is it wrong to use the database method?

What’s the best method to keep user connected and check in every page if the user is logged?

Answer 1

Use a $_SESSION and check it on every page

i.e.

$loggedIn = ($_SESSION['logged_in']) ? TRUE : FALSE;

if($loggedIn == TRUE){
    //Do stuff here for a logged in user...}`