title: How to prevent user from bypassing php authentication
body: <p>We call it html1 for simplicity.</p>
  
  <p>When a user goes to html1, there's a login2.php login page to enable access to client.php which is the hidden page.</p>
  
  <p>It then goes to checklogin.php...if the password and user name matches...it then goes to the hidden client.php page...if not..it goes back to homepage.</p>
  
  <p>The user has to login to be able to view the contents of hidden client.php page.</p>
  
  <p>However the user can access client.php by typing in ..../client.php on the address bar...therefore bypassing the auth page and rendering it useless.  I can just type  servername/client.php...and it still shows me the contents of client.php...but I want client.php...to be private!</p>
  
  <p><strong>How do I prevent this from happening?</strong></p>
  
  <p>thanks.</p>
  
  <p>first login page...</p>
  
  <pre><code>&lt;html&gt;
  &lt;head&gt;
  &lt;title&gt;Login Form&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;h2&gt;Login Form&lt;/h2&gt;
  &lt;table&gt;
  &lt;form method="post" action="checklogin2.php"&gt;
  &lt;div id="name"&gt;User Id: &lt;input type="text" name="****"&gt;&lt;/div&gt;
  &lt;div id="password"&gt;Password: &lt;input type="password" name="*******"&gt;&lt;/div&gt;
  &lt;div class="button"&gt;&lt;input type="submit" value="Login"&gt;&lt;/div&gt;
  &lt;/form&gt;
  &lt;/table&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>then it goes to....
  checklogin2.php</p>
  
  <pre><code> &lt;?php
      $*** = $_POST['****'];
      $***** = $_POST['***'];
  
  if($uid == '****' and $***** == '*****')
  {
          session_start();
          $_SESSION['sid']=session_id();
          header("location:securepage.php");
  }
  
  
  else
          {
                  header("location:index.html");
          }
  ?&gt;
  </code></pre>
  
  <p>Then it goes to...
  securepage.php</p>
  
  <pre><code>&lt;?php
          session_start();
          if($_SESSION['sid']==session_id())
          {
  
   header("location:client.php");
  
                  echo "&lt;a href='logout.php'&gt;Logout&lt;/a&gt;";
          }
          else
          {
                  header("location:login.php");
          }
  ?&gt;
  </code></pre>