PHP & MySQL Login Tutorial Series
Pt1: Introduction
Pt2: Setting up the database
Pt3: The front end and user validation
Pt4: The code to privatize a page
Pt5: Logout function and clearing the session ID

Part 4: Privatizing your pages

Now let’s look at the status function. This function will be called on every page we want to protect. It will check to see if the user has an active cookie, and will match the session id in the cookie to our session table. If there is a match, the user will be logged in. The function looks like this:

<?php
function status() {
$sessionid = $_COOKIE[test_account];
$oldtime = $time() – 3600;
$query = mysql_query(”SELECT * FROM user_sessions WHERE sessionid=’$sessionid’ AND timestamp>$oldtime”);
if(mysql_num_rows($query) == 1) {
$info = mysql_fetch_array($query);
return $info[userid];
}
return 0;
}
?>

First we’ll grab the session id that’s stored in the cookie “test_account.” The variable $oldtime is the oldest time the cookie could have been created. In this case that’s any time over the previous hour. The 3600 seconds must match the number of seconds in the setcookie function. We then query the session table for a match. If we find one we can pull the userid out of the session table and we’re logged in. Otherwise we return a 0.

Depending on your type of site, you may want to store frequently-used information in the session table for easy access. In this case, should we want to pull down the user’s username, we could use the userid pulled from the session table and then query the user_accounts table and match the user id for the account in question.

Next -> The Logout functions