Question

I have a login page where once a user is logged in successfully it echos a link to their personal page. When that page loads I want it to check if the user has access to it so someone doesn’t try to just type in http://www.mywebsite.com/bob.php in the url. I tried to use a cookie to send the user info but I realized you can’t use cookies after html has been written to the page. Does anyone know an efficient way to do this that is also fairly simple? Thanks

Answer 1

After the user logs in, assign his id to a session variable:

<?php
session_start();
$_SESSION["userid"] = $userid;
?>

On the protected page, check if the user has a $_SESSION[“userid”] variable set:

<?php
session_start();
if (isset($_SESSION["userid"])) {
   //show page
}else{
  echo "No rights";
}
?>