Using PHP Sessions to Keep Users Logged In

PHP sessions store a small amount of trusted server-side state between requests. A login system can use them to remember the authenticated user’s identifier, username and role.

Start the session

Call session_start() before HTML or other output:

<?php
session_start();

Set identity after successful login

Only set these values after a database user has been found and password_verify() succeeds:

session_regenerate_id(true);

$_SESSION["user_id"] = (int) $user["user_id"];
$_SESSION["username"] = $user["username"];
$_SESSION["role"] = $user["role"];

The role must come from the database. Never trust a role supplied by a login or registration form.

Read session values safely

<?php
session_start();

$username = $_SESSION["username"] ?? "";
$role = $_SESSION["role"] ?? "user";
?>
<p>
  Signed in as
  <?= htmlspecialchars($username, ENT_QUOTES, "UTF-8") ?>
</p>

Session values still need escaping when inserted into HTML.

What belongs in a session

Suitable:

• internal user identifier
• display username
• authorised role
• short status messages
• CSRF tokens

Avoid:

• plain-text passwords
• complete database records
• sensitive information not needed across requests
• values copied directly from unvalidated form fields

Important limits

A session records authentication state; it does not automatically protect a page. Every protected server-side route must check the required identity and role.

Check

• Session starts before output.
• ID is regenerated after successful login.
• Identity and role come from the database.
• Password is never stored in the session.
• Session text is escaped when displayed.
• Protected routes perform their own checks.