Member Avatar for gpdrums

Hi All,

Using php and MySQL, I completed a login session script and it works great. I am assigning the username and password to select users, and there will be no registration form.

My "users" table in MySQL has 5 columns as follows:

  • id
  • username
  • password
  • company
  • last_login

I need help with two things:

  1. How do I INSERT datetime to the MySQL db from the php login script?
  2. How do I echo the company name on every page of the website whether or not the page contains protected content?

The session_start() is on every page. Protected pages contain an authentication script after the session_start(). My authentication script does not verify the company name, but I want to display the company name upon session register for the duration of the session. Obviously, session_destroy() will terminate display of the company name.

Thanks for the help.

  • 2 Contributors
  • 2 Replies
  • 230 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by gpdrums

Dani AI

Generated

A few practical clarifications and hardening points that build on ’s helpful outline for .

’s basic flow—authenticate, set session state, update last_login—is fine as a starting point. For production, prefer a modern DB API (PDO or mysqli) with prepared statements, never store plaintext passwords (use password_hash/password_verify), and call session_regenerate_id(true) after successful authentication to reduce fixation risk. Keep session data minimal (user id and a company identifier) and apply output escaping when printing any session values to avoid XSS.

For showing the company on every page, use a single header include that runs after session_start. Caching the company name in session is low-cost and OK if it rarely changes; if company names change often, store only the company_id in session and fetch the latest name when rendering. Example header rendering (different from earlier snippets on the thread):

<?php
// header.php (included after session_start())
$company = $_SESSION['user']['company'] ?? null;
if ($company) {
    echo '<div class="company">' . htmlspecialchars($company, ENT_QUOTES, 'UTF-8') . '</div>';
}
?>

For last_login and timezones: make the column TIMESTAMP or DATETIME and store times in UTC (convert for display). Either let MySQL set CURRENT_TIMESTAMP by default or update explicitly on successful login using a parameterized query. Example using PDO with a bound id:

$stmt = $pdo->prepare('UPDATE users SET last_login = UTC_TIMESTAMP() WHERE id = :id');
$stmt->execute([':id' => $userId]);

Extra notes: enable secure session cookie flags (HttpOnly, Secure when on HTTPS), use a short session inactivity timeout tracked via a last_activity session value, and avoid keeping sensitive data in the session. These steps keep the simple flow suggested by functional while improving security, correctness, and maintainability.

Recommended Answers

All 2 Replies

Member Avatar for effu

How do I INSERT datetime to the MySQL db from the php login script?

Assuming you have the code in place to set up the username and password vars from your form:

//connect to database
dbConnect();
//query the database
$query = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'");
//if there is a match proceed
if (mysql_num_rows($query) == 1) {

$row = mysql_fetch_array($query);
//set a session variable to company
$_SESSION['company'] = $row['company'];
}

//now would be a good time to update the database for this user
$lastLoginQuery = mysql_query("UPDATE users set last_login=NOW() WHERE id = $row[id]");

How do I echo the company name on every page of the website whether or not the page contains protected content?

On each page after the session_start(); function, try some code like this:

//check to see if the variable is set in the $_SESSION array
if (isset($_SESSION['company']) {
//echo it to the browser, or whatever you want to do with it
 echo "<h2>".$_SESSION['company']."</h2>";
}
Member Avatar for gpdrums

Joe, thank you. That makes mucho sense and I'm def on the right track. I can't try it out til tomorrow, but I'll post back and let you know. ~gp

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.