Question

if($_POST['user'] == 'anita' && $_POST['pw'] == '123')
{
    $_SESSION['username'] = $_POST['user'];
    echo "Welcome, " . $user;
    $loggedin = true;
}else
{
    die('Log in details incorrect.');
}

if(isset($_SESSION['username']))
{
   // Show website edit menu
}

I’m creating a website and I was thinking about adding a small self made CMS for my customer to use, so she can update the site herself.

Is this a safe way to save someones details? can I just check if $_SESSION[‘username’] is set to validate that the user is logged in?

Answer 1

Well, yes.
Setting a session on a server side it pretty safe, as it means the hacker will have to get access to server files writing, or find a really horrible bug in your client code that leads to file rewrites.

Just do some research for: session fixation and how to prevent it, and try to use SSL on the CMS side.