Check if user is logged in?

Originally Posted by Moman

Hello guys,

I am new to PHP and I thought I want to ask, Say I created a login page and if the user/pass match the datbase one it will proceed to admin.php else it will give you a red error "wrong user / pass " but if I try to access admin.php without login script it also works. What's the way to restrict non-logged in users to see this page?

Regards,
Moman

Originally Posted by markusn00b

When someone logs in you should set a session
[php]
$_SESSION['logged_in'] = true;
[/php]
then on the admin page you check to see if this is set
[php]
if(isset($_SESSION['logged_in']))
{
# logged in
}
else
{
# not logged in
}
[/php]

Originally Posted by markusn00b

I changed it a little bit.
log in:
[php]<?php
session_start(); # start up the session

$host="localhost";
$username="root";
$password="root";
$db_name="data";
$tbl_name="login";

mysql_connect("$host", "$username", "$password")or die("Unable to connect");
mysql_select_db("$db_name")or die("Unable to select database");


$username=$_POST['username'];
$password=$_POST['password'];


$username = stripslashes($username);
$password = stripslashes($password);
$username = mysql_real_escape_string($username);
$password = mysql_real_escape_string($password);

$sql="SELECT * FROM $tbl_name WHERE username='$username' and password='$password'";
$result=mysql_query($sql);


$count=mysql_num_rows($result);


if($count==1)
{
$_SESSION['logged_in'] = true;
header("location:login_success.php");
}
else
{
echo "Wrong Username or Password, Please be careful when typing them.";
}

?>[/php]

What code do you have for admin.php?