PHP session for user authentication

Question

I'm going to use cookies and sessions to indentify the user. So, sessions will be used only when user chose the 'Don't remeber me' option. I include the identification file in the top of every page of website. User's session looks like $_SESSION['user']

And than is my question:

Must I place to the authentication file session_start() instruction? I asked it because new session creates every time I use this instruction.

Update http://pastebin.com/Nh3zj6mR user identification script

session_start() creates a new session or resumes the old - unless you do something before calling this session_start(). Then I presume it would always start a new one... — Grzegorz
– Grzegorz, Commented Aug 29, 2012 at 18:30
@John can you, please, explain why or give a good source to read about it? — treng
– treng, Commented Aug 29, 2012 at 18:39
if (isset($_COOKIE['rwt'])) { $QH=$this->_DBH->prepare("SELECT * FROM accounts WHERE cookie=:cookie_value"); You can simple edit the cookie to another username, and there your are. It is better to use some sort of hash, store that in the cookie, en get the data you need from the database with that hash. Also bind a that cookie to one ip address. — Green Black
– Green Black, Commented Aug 29, 2012 at 19:08
@John pastebin.com/aQEzzPJM I create cookie value this way, than insert it to the database — treng
– treng, Commented Aug 29, 2012 at 19:13

donald123 · Accepted Answer · 2012-08-29 18:33:13Z

1

Yes, you have to place session_start() at top of every php page (before any output was generated, no headers must have sent before) to tell php to accept / start session, expect your php.ini is setup, that sessions start automatic.

I asked it because new session creates every time I use this instruction.<<

That is a hint, that your browser ignore (disallow) session cookies

answered Aug 29, 2012 at 18:33

donald123

5,7883 gold badges28 silver badges24 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

treng Over a year ago

and is normal that session starts even if user's cookie exists?

donald123 Over a year ago

please show us your logic (code) ... then we can say more about the "fault"

donald123 Over a year ago

sorry ... but in your code you get an boolean result ... modify your code and let show which false is fired .... example line 10 "return true;" modify it for dump in echo "false in ".__LINE__." return false";die();

treng Over a year ago

sorry, but in this code I check if user with this cookie or session exists, and it's supposed to have a boolean result :)

Marc B · Accepted Answer · 2012-08-29 18:30:39Z

1

Unless you execute session_start(), PHP's session mechanism will NOT activate. The $_SESSION will be present, you'll be able to read/modify it, but its values will NOT be persisted - e.g... the contents will be lost when the script exits.

If you are running session_start() in every script that uses session data, but the session data is not showing up, then there's probably a misconfiguration causing the session cookie to be lost, and PHP is creating a new session each time.

answered Aug 29, 2012 at 18:30

Marc B

362k44 gold badges433 silver badges508 bronze badges

Collectives™ on Stack Overflow

PHP session for user authentication

2 Answers 2

4 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related