Best Practice for site-wide testing and reacting to logged-in status
<p>I'm working on a small, very application-specific CMS.  There's nothing financial going on, and the content isn't sensitive really (it's mostly managing relationships between pieces of art), so security isn't a high priority, but still we're using a login system with a controlled group of users for each installation.</p>

<p>The entry page has a login form - success sets a session variable to the user table's PK for the user, and redirects to an arbitrary view page.  That variable is also used to track any changes made by that user.</p>

<p>I'm auto_prepending to all pages a small script that just checks if that session variable is set - if not, the user is bounced back to the login page.  This works, but seems clumsy - especially since I need to 'exempt' the login page, so I used an ugly little hack, which is basically this:</p>

<pre><code>if(!isset($_SESSION['user']) &amp;&amp; strpos($_SERVER['PHP_SELF'], '/login.php') !== 0) {
    header('Location: /login.php');
}
</code></pre>

<p>The above is simplified a little from the actual script, but basically demonstrates what's happening.</p>

<p>I'm wondering if there's an established best-practice for something like this - testing for logged-in status and redirecting when that status isn't set...</p>

<p>tyia</p>
