会员专区

Question

When building a page that is to be accessible to members only, is the following the correct php:

<?php if($_SESSION['logged_in']): ?>

// all code for page here

<?php endif; ?>

Does all of my html / php sit between these two lines?

Are there any other ways of doing this that are better?

What security issues should I be aware of?

My content is not particularly sensitive but may be in the future.

Answer 1

Speaking strictly in terms of writing legible code, why not:

<?php
if (!$_SESSION['logged_in']) {
   header("Location: login.php");
   exit;
}
?>

<!-- // all code for page here -->

Or similar.

Answer 2

A better way might be:

<?php if(!$_SESSION['logged_in']) { header('Location:loginpage.php'); exit; } ?>

Then your page can continue as normal, and a user who isn't logged in will get the login page instead.

Edit: added the required exit call as per the header documentation.

Answer 3

You certainly can put all your HTML / PHP code in between the conditional if you like. Just be aware that if you do, unauthenticated users won't see anything when they hit the page. You may want to put design elements outside the conditional, or at least use an else: before the endif;

Answer 4

<?php
 a = checksession(args); //your own function for checking session
 if(!a)
   header("Location: 401.shtml");  //This can contain advisory regarding login
?>    

This will be at the top of your page, rest you can decide.