Object Oriented php Session management

Question

I have a webapp that uses login/logouts so I have session management. Basically every page so far starts with

session_start();  
if(!isset($_SESSION['username'])) {header("Location: index.php");} else { rest of the page's functionality}

I am now creating a class (User.php); that will be accessed by another .php page. Do I need to implement the above for security, and if so how? Should I put classes above the webroot? Thanks

giorgio · Accepted Answer · 2012-01-06 14:41:03Z

1

first of all, although i assume you've thought of this; just to check if the username is set in a session is not particularly save. If you want to check if a user is logged in some additional tests should be present.

than back to your question; a page could possibly access the User class even if no logged in user exists (eg. when you want to display this particular users' public comments on a blog post). So no, your test would not be needed. Furthermore you could also build in a check if the user is logged in into the User class (or better still; the Authentication class you'll build around it), so you could do something like:

if(Authentication::is_logged_in($_SESSION['username']) === true) {
    echo 'yeeehaaaa! You\'re logged in bro!';
} else {
    echo 'what are you doing here?! Get lost! (or log in)';
}

answered Jan 6, 2012 at 14:41

giorgio

10.2k2 gold badges30 silver badges41 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user1114 Over a year ago

Thanks, what other security measures should I take to make sure a user is logged in? How can someone get past the if(!isset($_Session['username'])) security?

giorgio Over a year ago

you might want to store a timestamp to check the expiry (eg. 1 hour after login), but definitely a password hash build up from eg. the timestamp, (encrypted) password, a constant and the clients public ip. This will prevent someone from 'stealing' the session. The hash is created at login in and checked every time the hypothetical is_logged_in() function is called.

Collectives™ on Stack Overflow

Object Oriented php Session management

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related