PHP login user logic

Question

I've scrapped all the tutorials that have never worked for one reason or another, and decided to roll out my own registration/login feature on my own, and to my surprise it actually works!

But what I don't get is how the logic behind keeping somebody logged in works! Like, once they've logged in, do I just $_POST their data to whatever other page they visit and once they're on the new page $_REQUEST that post data from the URL and display a message like: "yeah, you're still logged in"?

I'm a bit confused atm, so I hope this question doesn't confuse you too.

Answer 1

Let us have we have pages like login.php after_login_page1.php after_login_page2.php

You can follow these simple steps

1. Set $_SESSION['id'] = $userid //userid from db in login.php

2. always have session_start() in the successive pages like after_login_page1.php, after_login_page2.php

3. Check if(! isset($_SESSION['id'])){ header("Location: login.php"); }

4. at the logout.php page give $_SESSION['id']=''; and do a session_destroy()