PHP single user login control for website

Posted on 2007-03-22
Medium Priority
Last Modified: 2012-06-22
Dear experts,
I have a problem here. I have search experts-exchange site for some time, but i failed to
find a proper solution.

I am setting up a web site (written in PHP) that will allow multiple user login simultaneously.
But one user is allow to have only one active session at any time.

What I have done to acheive this is:
1) Set up a database table with 2 fields, username & timestamp.
2) On login page, while user sign in, the script will delete any session entry that is more than 20mins old. Then check if the username has an entry in the table. If it is, login failed. Else, login successfull.
3) After a user login, set the username into the session variable, e.g. $_SESSION['username'],
and insert the username and time() into the DB.
4) On top of every web page, the script will check if the session variable is empty. If it is,
it will redirect the user back to login page.
5) Following the check session variable script, a script will update the timestamp in the DB table.
The same script will check if the timestamp in the DB table is more than 20mins old. If
it is, the entry will be deleted.
6) When a user logout, the logout script will remove the user's entry in the database table.

The problem:
When a user logged in the system, his username will always be shown on screen. It is a
direct echo from the $_SESSION['username']. But sometimes, the username will disappear. I
assume the session is expired. But, he still can browse the site freely. Suppose when he
browse other page, the first script that check the session variable will get an "Empty" value,
and redirect the user to login page. But somtimes it didn't happen. In this condition, even though
the user click on logout, the entry in the database table remains because of missing username for deleting
the DB table entry. Then the user will have to wait for 20mins (or less) in order to sign in again.

If the user just close the browser window without click on logout. The entry in DB will
remain and the user will have to wait for 20mins to login again.

Sometimes when a user let the page idle for a while,  he click on a link to another page,
it will redirect to the login page. I guess this is due to the system session expired. It is
what the script is doing. But the login data entry in the DB table remains. It will need 20mins
for the user to login again.

Is there any proper way to avoid a user wait for 20mins to relogin into the web site?
Well, I have been thinking to set the time to 5mins. But, it still didn't
solve the problem.

What is really happen to the session variable. When it expires, the PHP script should
log (redirect) the user out. But sometimes it didn't.

Other info:
1) Script to set the session variable:
$_SESSION['username'] = $username;

2) The script to check seesion:
if (!isset($_SESSION['username']))
      header('Location:index.php?redirection=' . urlencode($_SERVER['PHP_SELF'] . '?' . $_SERVER['QUERY_STRING']) );

Question by:llping8
  • 4
  • 3
LVL 14

Accepted Solution

Vel Eous earned 600 total points
ID: 18775335
Try the zend_auth framework module:

LVL 10

Assisted Solution

ClickCentric earned 400 total points
ID: 18776589
What you want is a custom session handler that utilizes the database rather than the session files.   Though it sounds like there's a flaw somewhere in your session implementation which unless fixed would likely still not work right even if you did put it in a database.

Author Comment

ID: 18776727
I am thinking, it may because of the session.gc_maxlifetime = 1440 (which is 24minutes) that cause the session variable disappeared. But if it is cleaned, user should be redirected to login page. It must be something wrong. I have to recheck the implementation.

I have refer to zend_auth framework, i can't find a way to implement it to solve my problem yet.
Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.


Author Comment

ID: 18790923
Dear experts,
I have change my approach.
I leave the session alone and work on the single user login separately.
Now, I include an IFRAME on every page. In the frame, there is a PHP page that with HTML META tag - refresh.
The PHP code in IFRAME will update the database with the latest time every 15sec. Thus, as long as the user is viewing a page, it will refresh, and the username will always exist in the DB table. The same username cannot login again. If the existing user logout or close the window, the DB table will stop being refreshed. Another code will check and delete those entries with idle time more than 30 seconds. After that, the same user can login again. So, the longest time a user have to wait is around 30sec.

It works fine. But it seems like the original session.gc_maxlifetime is not working anymore. The user session will not expire after idle for 24 mins.
LVL 10

Expert Comment

ID: 18798961
You're breaking your session, that's why it's not timing out.  Your workaround really is not a good idea.  What happens if someone leaves their computer on that page?  Do you just let it refresh forever? You really should figure out what's wrong with your session implementation and fix it.  I'm not sure why you're so interested in storing it in the database, but you can use a custom session handler for that and it's really not that hard.  

Author Comment

ID: 18799003
Dear ClickCentric,
You are correct. The concern is if someone keep the page open forever.
I don't understand how to use a custom session handler for the purpose of letting one user to login at one time. Can you show me how? In my knowledge, if someone login the system, the session will register. But then, if he try to login using another computer or browser, how can the system know that the user already login? because they are 2 different session. Can one session check if there is another session that has the same userid exist?
LVL 10

Expert Comment

ID: 18799055
If they're logging in, they're using some sort of username.  You determine whether they're logged in based on that.  Whether or not you use sessions to store that information is another matter.  Session handlers are good for that, but I think you're misunderstanding how sessions operate and what you have to do in order to prevent them from going away/timing out.  You should really look at www.php.net and read up on them.  Or even better, find a book that deals with them with real-world scenarios.  They have to be interwoven into your site and they sometimes require parameter tweaking to get the desired results.  It's not the type of thing where I can just say add this line to this file and everything will work (while it is possible that's all you need, I'd need to see all of the source code to determine that).  

Author Comment

ID: 18805639
Thank you very much. ClickCenteric.
I appreciate your information. I think I need to do a deep study in this issue.

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

There are times when I have encountered the need to decompress a response from a PHP request. This is how it's done, but you must have control of the request and you can set the Accept-Encoding header.
I recently worked on a Wordpress site that utilized the popular ContactForm7 (https://contactform7.com/) plug-in that only sends an email and does not save data. The client wanted the data saved to a custom CRM database. This is my solution.
The viewer will learn how to create and use a small PHP class to apply a watermark to an image. This video shows the viewer the setup for the PHP watermark as well as important coding language. Continue to Part 2 to learn the core code used in creat…
The viewer will learn how to create a basic form using some HTML5 and PHP for later processing. Set up your basic HTML file. Open your form tag and set the method and action attributes.: (CODE) Set up your first few inputs one for the name and …

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question