title: PHP Secure Session Login - Best Practice
body: <p>As part of my web app. This is some code I am considering (I'm not the best of PHP programmers but I programming my own app for a project):</p>
  
  <pre><code>// Start session
  session_start();
  // Is the user already logged in?
  if (isset($_SESSION['username'])) {
      header('Location: members-only-page.php');
  }
  </code></pre>
  
  <p>I want to know, if my login structure is like this, is this secure.</p>
  
  <blockquote>
    <ul>
    <li><a href="http://site.com/" rel="nofollow">http://site.com/</a> </li>
    <li><a href="https://site.com/login.php" rel="nofollow">https://site.com/login.php</a></li>
    <li><a href="https://site.com/login-action.php" rel="nofollow">https://site.com/login-action.php</a> (MySQL login check, with md5    password check) </li>
    <li><a href="http://site.com/cp/members-only-page.php" rel="nofollow">http://site.com/cp/members-only-page.php</a></li>
    </ul>
  </blockquote>
  
  <p>I am using MD5(); but I am not entirely happy with the whole $_session["user"]="1" approach that scripts use; surely the likes of vBulletin wouldn't do this?</p>
  
  <p>Appreciate a reply. I've not even touched on the idea of this being Ajax ha!</p>
  
  <p><strong>UPDATE - Psuedo code of my approach. Everything on SSL.</strong></p>
  
  <pre><code>// vars
  login string post
  password string post
  
  // validation aside from ajax now
  login string is empty
  redirect to login form with error
  password string is empty
  redirect to login form with error
  
  // mysql
  escape strings
  clean html strings
  
  mysql connect external mysql server
  if login string is user
      if password md5 match with database md5
          session logged in
      else
          session failed password invalid
          redirect to login form user/pass error
      end if
  else
      session failed username invalid
      redirect to login form user/pass error
  end if
  
  if file called direct
      redirect 404
      alert_admin function type hacking attempt login page
  end if
  </code></pre>