Members only area

Question

When building a page that is to be accessible to members only, is the following the correct php:

<?php if($_SESSION['logged_in']): ?>

// all code for page here

<?php endif; ?>

Does all of my html / php sit between these two lines?

Are there any other ways of doing this that are better?

What security issues should I be aware of?

My content is not particularly sensitive but may be in the future.

Answer 1

Speaking strictly in terms of writing legible code, why not:

<?php
if (!$_SESSION['logged_in']) {
   header("Location: login.php");
   exit;
}
?>

<!-- // all code for page here -->

Or similar.

Answer 2

A better way might be:

<?php if(!$_SESSION['logged_in']) { header('Location:loginpage.php'); exit; } ?>

Then your page can continue as normal, and a user who isn't logged in will get the login page instead.

Edit: added the required exit call as per the header documentation.