Skip to main content

Using PHP Sessions to Keep Users Logged In

In the previous tutorial, you created a login form that verified usernames and passwords. In this tutorial, you will use PHP sessions to remember who is logged in and keep them signed in while they navigate your website.

What is a Session?

A session allows PHP to store information about a user while they move between pages.

Without sessions, a website would forget who the user is every time a new page loads.

Start a Session

Open your existing:

login.php

Add the following code at the very top of the file:

<?php

session_start();

?>

The session_start() function must be called before any HTML is sent to the browser.

Your file should now begin with:

<?php

session_start();

$conn = new mysqli(
    "localhost",
    "root",
    "",
    "project_db"
);

Store User Information in the Session

Locate this section:

if (
    password_verify(
        $password,
        $user["password"]
    )
) {

    echo "<p>Login successful.</p>";

}

Replace it with:

if (
    password_verify(
        $password,
        $user["password"]
    )
) {

    $_SESSION["user_id"] = $user["user_id"];
    $_SESSION["username"] = $user["username"];

    echo "<p>Login successful.</p>";

}

When a user logs in successfully, their information is now stored in the session.

Create a Members Page

Create a new file called:

members.php

Add the following code:

<?php

session_start();

?>

<!DOCTYPE html>
<html>
<head>
    <title>Members Area</title>
</head>
<body>

<h1>Members Area</h1>

<p>Welcome,
<?php echo $_SESSION["username"]; ?>
</p>

</body>
</html>

Save the file.

Open the Members Page

Visit:

http://localhost/members.php

If you have logged in successfully, you should see:

Members Area

Welcome, admin

or whatever username was used to log in.

Display Additional Session Information

You can access any values stored in the session.

For example:

<p>User ID:
<?php echo $_SESSION["user_id"]; ?>
</p>

Result:

User ID: 1

View the Session Data

Add the following code to the members page:

<pre>
<?php
print_r($_SESSION);
?>
</pre>

Example output:

Array
(
    [user_id] => 1
    [username] => admin
)

This can be useful when testing.

Redirect Users After Login

Instead of displaying:

echo "<p>Login successful.</p>";

replace the success code with:

$_SESSION["user_id"] = $user["user_id"];
$_SESSION["username"] = $user["username"];

header("Location: members.php");
exit();

Now users will be automatically redirected to the members page after a successful login.

Test the Complete Process

  1. Open:
http://localhost/login.php

  1. Log in using an existing account.

  2. You should be redirected to:

http://localhost/members.php
  1. The page should display your username.

Screenshot Placeholder

Insert screenshot showing the successful login redirect.

Complete Login Success Code

if (
    password_verify(
        $password,
        $user["password"]
    )
) {

    $_SESSION["user_id"] = $user["user_id"];
    $_SESSION["username"] = $user["username"];

    header("Location: members.php");
    exit();

}

Complete Members Page

<?php

session_start();

?>

<!DOCTYPE html>
<html>
<head>
    <title>Members Area</title>
</head>
<body>

<h1>Members Area</h1>

<p>Welcome,
<?php echo $_SESSION["username"]; ?>
</p>

<p>User ID:
<?php echo $_SESSION["user_id"]; ?>
</p>

</body>
</html>

You now have a working login system that remembers users between pages using PHP sessions.

Next tutorial: Protecting Pages and Preventing Unauthorised Access.

Back to top