title: PHP: MVC User authentication and global user object?
body: <p>I'm writing my first real MVC-application with PHP. I'm not using a framework because my application is so small that I figured it would be faster to write everything from scratch.</p>
  
  <p>In my app, users can register, login and then write/edit/delete content. Each piece of content references its owner by a userid-column in the database.</p>
  
  <p>I am now about to implement user access restrictions (in the sense that users can only view/edit/delete their OWN content/items/models). I'm wondering where the check for "valid access" should happen and where user-objects are instantiated.</p>
  
  <p>I mean, I definitely need information about the current user in controllers, models and views. So I'm thinking if it's viable to have a global user object (defined in index.php) that stores all the user information so I could access it comfortably from each part of my application.</p>
  
  <p>At the moment, this snippet grants my controllers access to user information which I then also store in the data-array that is passed to the view:</p>
  
  <pre><code>class Controller {
      protected $data, $id, $user;
      public function __construct($action = null, $data = null) {
          if (User::isLoggedIn()) {
              $this-&gt;user = new User($_SESSION['user']);
              $this-&gt;data['user'] = $this-&gt;user;
          }
      }
  }
  </code></pre>
  
  <p>Following this pattern, I'd have to pass on user information to each model I create or alternatively have them instantiate their own user-object.</p>
  
  <p>What is the way to go here? Global user object, instantiation in each model or passing the user-object as a parameter to models and views?</p>
  
  <p>Thank you for your help!</p>