Member Avatar for trektrak

I've created a web application page with login and session login

basically a

<?php session_start() ?>

do I really need to put this code on every page of my php ?
because session login only active on the first page after I do login..

Anyone.. Help me on this.. Thanks

  • 3 Contributors
  • 7 Replies
  • 208 Views
  • 18 Hours Discussion Span
  • Latest Post Latest Post by vibhaJ

Dani AI

Generated

Short expert note: the session mechanism in PHP is tied to a session cookie (the browser-held session id). That is why the login works on the first page but appears to “drop” afterwards: the session id either isn’t being sent or the server isn’t resuming the session. Centralizing startup into one include (as recommended) is a good pattern: initialize session handling, set secure cookie parameters, and load common helpers from that single file so every page behaves the same. Storing a small user identifier in the session (as suggested) is the correct way to mark a logged-in user.

Quick checklist to diagnose a session disappearing issue:

  • Inspect the login response headers (browser DevTools → Network) to confirm a Set-Cookie for the session id is present.
  • Check for “headers already sent” warnings or any output sent before the session is started.
  • Verify cookie domain/path and www vs non-www or http vs https mismatches.
  • Confirm browser cookie settings and that PHP’s session.save_path is writable.
  • If the session is meant to survive browser restarts, prefer a separate persistent “remember me” token instead of relying on session cookie lifetime.

Secure, token-based “remember me” pattern (outline):

// create on successful login
$selector  = bin2hex(random_bytes(8));
$validator = bin2hex(random_bytes(32));
$expires   = time() + 60*60*24*30; // 30 days
$cookieVal = $selector . ':' . $validator;
// store $selector, hash('sha256',$validator), $userId, $expires in DB
setcookie('remember', $cookieVal, [
  'expires' => $expires, 'path' => '/', 'domain' => '.example.com',
  'secure' => true, 'httponly' => true, 'samesite' => 'Lax'
]);

On each request, if no active session but the cookie exists: split selector/validator, find the selector row, compare hashed validator, create a new session if it matches, rotate the validator (generate a fresh one), and delete the DB row + cookie if invalid.

Security notes: never store passwords or raw tokens in cookies/DB; always use HTTPS; expire and revoke tokens on logout; call session_regenerate_id() after login to prevent fixation. Using a single include for session boot and login-checks (only on protected pages) will make the behavior consistent across the site and avoid the “first page only” problem described by .

Recommended Answers

All 7 Replies

Member Avatar for vibhaJ

If you want to check that session's value on other pages, i.e. if user is logged in or not, then you have to add it on all top of page.

Member Avatar for trektrak

because after I login..when I try to click on the different page...I'm out of the session login ... that's the problem ..
So basically adding on every page.. will solve the problem yea ?

Member Avatar for vibhaJ

yup..

Member Avatar for trektrak

if I may know.. how to add cookies to remember the session everytime going back to the first page ? if I may know...

Member Avatar for Subless

Do what I do, I created a "global.php" page and I include it at the top of every page. At the very top of "global.php" I have "session_start();" and below that I have all the variables I want to use, that way I can check if the user is logged in or not on every page, and use the variables I have set.

Member Avatar for trektrak

any sample or references ? Sorry I'm bit new with this .. :)

Member Avatar for vibhaJ

When user login you can set user's id in session.

$_SESSION['sess_userId'] = 12; // whatever id

Below is the function check if user is login or not.

function isUserLogin()
{
    if(!isset($_SESSION['sess_userId']))
    {       
        header("location:login.php");
        exit;
    }   
}

Now call this functionisUserLogin(); on top of page where you want guest restriction.
Not include in global.php otherwise all page will be asked for login.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.