Handling users connection to the application This is a simple User class that I'm using throughout the application for anything related to the users. To tell if a user is logged in or not, I check the presence of the userID in the $_SESSION. When I'm logging in the user, I simply set the $_SESSION["userID"] equal to the ID of the user.

class User{

protected $pdo;

public function __construct(PDO $pdo)
{
    $this-&gt;pdo = $pdo;
}

public function getID()
{
    if(!$this-&gt;isConnected()) return 0;
    return $_SESSION["userID"];
}

public function isConnected()
{
    return !empty($_SESSION["userID"]);
}

public function login($username, $password)
{
    $q1 = $this-&gt;pdo-&gt;prepare("SELECT * FROM users WHERE username = ?");
    $q1-&gt;execute([$username]);
    $user = $q1-&gt;fetch();

    if(empty($user)) return false;
    if(!password_verify($password, $user-&gt;password)) return false;

    $_SESSION["userID"] = $user-&gt;id;
    $_SESSION["username"] = $user-&gt;username;
    return true;
}   
}


I'm putting everything in a class just so that it's organized and easily accessible, but I'm pretty sure I'm not doing this properly. I presume that the correct way to handle this is to use properties for the class (example: $isConnected, $id) and change them when the user logs in/logs out. 

However, I'm not sure how I would do that and avoid overwriting the user object every time the script loads (page refresh), so at the moment I'm doing it like that.

It works fine, but I really feel like I'm missing the point of OOP here. I'm a beginner when it comes to OOP with PHP, so please don't be too harsh! I'd really like some input from experienced developers.
If your class takes care of the authentication of your application don't call it User but Auth or Authentication.

You shouldn't "putting everything in a class". Wrapping your code in a class is not OOP. See SOLID and start with the Single responsibility. Every class should have one single responsibility. Your class takes care to recover users data and handles authentication on your application. Too much responsibility for one class. Separate the user handling from the database query.

$_SESSION is an hard dependency. $_SESSION is global, and global is evil.  If at some point you choose to store session data in a different storage you will need to change the implementation of the class. If you write orthogonal code you will enables to changes isolated areas of the code without influence other areas. 
You can use abstractions such as those provided by packages like Symfony2, HttpFoundation.

Although there are few who worry about it.