how can i use sessions to get user information? - php

Question

i am trying to get my head around sessions and how to use them to show user data and grant access to areas of the site etc...
i have session_start(); at the beginning of my config file, then proceed to do the connection to database etc...
i then have a User.php class which is as follows:
<?php
include('Password.php');
class User extends Password{
private $db;
function __construct($db){
parent::__construct();
$this->_db = $db;
}
public function is_logged_in(){
if(isset($_SESSION['loggedin']) && $_SESSION['loggedin'] == true){
return true;
}
}
private function get_user_hash($username){
try {
$stmt = $this->_db->prepare('SELECT password FROM members WHERE username = :username');
$stmt->execute(array('username' => $username));
$row = $stmt->fetch();
return $row['password'];
} catch(PDOException $e) {
echo '<p class="error">'.$e->getMessage().'</p>';
}
}
public function login($username,$password){
$hashed = $this->get_user_hash($username);
if($this->password_verify($password,$hashed) == 1){
$_SESSION['loggedin'] = true;
return true;
}
}
public function logout(){
session_destroy();
}
}
?>
which when i use var_dump($_SESSION); returns:
array(1) { ["loggedin"]=> bool(true) }
what i am wanting to do is have things like "Hello, '(persons username)' welcome to the '(basic,premium,admin etc...)' area of the site".
so i think i want to be doing things like $_SESSION['memberID'], $_SESSION['username'], $_SESSION['level']
so... first of all am i looking at the right area to do this kind of thing (User.php) and would modifying anything i already have allow me to do this, or do i need to create another function(s) and query the database etc... if i do things like $_SESSION['username'] = 'mee'; then it will display 'mee', but what i am wanting to do is get the username for whichever user is logged in.
*apologies in advance if this makes little sense or is confusing, iv been trying to figure this out for some time now and literally nothing im doing makes sense - brain overload :/

Answer 1

For security purposes it is prudent to query the database for every subsequent request to restricted areas in your application. This can be achieved by simply storing the user id in the session variable and pulling the user data with every request by the stored user id. This way if access is revoked while the user is still logged in the system will respond correctly
This functionality could be achieved like so:
// after successfully getting user by the provided username/password
$_SESSION['logged_in_user_id'] = $user['id']
Now, on every request you simply check:
if (isset($_SESSION['logged_in_user_id'])) {
$currentUser = (new User())->find($_SESSION['logged_in_user_id']);
}
In your user model you could do something like this:
public function find($id) {
try {
$stmt = $this->_db->prepare('SELECT name, address, user_level, email FROM members WHERE id = :id');
$stmt->execute(array('id' => $id));
$row = $stmt->fetchAll();
$user = new self();
$user->fill($row[0]);
return $user;
} catch(PDOException $e) {
echo '<p class="error">'.$e->getMessage().'</p>';
} catch (Exception $e) {}
return null;
}
public function fill(array $data) {
foreach ($data as $key => $value) {
$this->$key = $value;
}
return $this;
}
To log the user out:
unset($_SESSION['logged_in_user_id']);
This method has the added benefit of keeping sensitive user data out of the plain text session files on your server which could be read by anyone with access to the box.
Now, with sessions you do need to keep in mind the potential for session hijacking but that is another discussion and there are tons of PHP packages out there to help protected against this vulnerability.
If you are not concerned with security and just want to get it working with as little effort as possible (not recommended) you can simply store the user data array in the session and use whatever you need from it:
Log in code:
public function login($username,$password){
if ($user = $this->getWithCredentials($username, $password) {
$_SESSION['logged_in_user'] = json_encode($user);
return true;
}
return false;
}
public function getWithCredentials($username, $password) {
try {
$hashedPassword = $this->myPasswordHashAlgorithm($password);
$stmt = $this->_db->prepare('SELECT id, name, address, email FROM members WHERE username = :username AND password = :password');
$stmt->execute(array('username' => $username, 'password' => $hashedPassword));
$row = $stmt->fetch();
return $row;
} catch(PDOException $e) {
echo '<p class="error">'.$e->getMessage().'</p>';
} catch (Exception $e) {}
return null;
}
Then, to get user data on subsequent requests:
$user = isset($_SESSION['logged_in_user']) ? json_decode($_SESSION['logged_in_user'] : null;