如何确保没有登录就无法访问除登录页面之外的其他页面？

Question

In my PHP application, the pages beyond login page must be visible only when user is logged in. This is how I log in:

if($status=="ok"){ 
    session_start();
echo '<script>window.location.assign("/Annapoorna/Welcome_Page.php");</script>'; 
}else{ 
echo '<script>alert("username / password is invalid");window.history.go(-1);</script>'; 
} 

Status gets Ok if username and passwords match.

Also, how can I ensure that a user who is not logged in cannot access pages apart from the login page, even by putting direct URL of other page? How do I redirect such a request to login page?

Answer 1

Create one script that check the session. and that file should be included in all the pages except login file. Consider the following example.

File Name : session_check.php

<?php
session_start();
if(!isset($_SESSION["status"]) && $_SESSION["status"]=='')
{
   header('Location: index.php'); // your login page
   exit;
}
?>

So this will check in all the pages that your 'status' session is empty or not. If your session is empty that means that use is not logged in. and if status is OK, that means user is logged in.

Now, in your login page, you have to add condition as per below.

<?php
session_start();
if(isset($_SESSION["status"]) && $_SESSION["status"]=='OK')
{
   header("Location: home.php");
   exit;
}
?>

Now, this will check that if the status session is not empty, then will redirect to home.php file (after the login file). If session is empty, then it will stay login page.

Answer 2

  <?php
    session_start();
    // do this in header of pages where you don't need access of all users
    if(isset($_SESSION['status']) && $_SESSION['status'] != 'OK'){
         // go and login user
         header("Location: login.php"); 
         die();

    }