Posted by l3vi501 on 07/04/06 05:25

Mike,

>From what your saying, and unless Im missing something. You are
starting a 2nd process that if the user session is true then they are
logged in. Simply put that is like asking someone if they are a member
of a club and they are saying yes when they really are not. It's to
easy to get around. As for my method Im only doing a SELECT from DB for
user ID and pass that is MD5 for security. In that event it is faster
and requires less queries in the event that I need to collect other
data on the user to provide them services.

Stan McCann,

A session is nothing more then a cookie that is stored with the user
and expires when the browser closes or the session is ended.

---

If you choose to use DB session style authentication you will be
looking at more processing time and heaver load time as more user are
using the system. The up side to it is that if the user anti-virus
software or browser blocks the session the server will be able to
handle it a little bit better and keep the user logged in.

JavaScript will only be one part of the process to keep track of the
user time. JavaScript would be used to make the users experience more
enjoyable if they have a tendency to sit on a page for more time then
the allowed time limit. You will to store last page load via the
session or db and use something like "... WHERE LastPageLoad <
date_sub(now(), interval 15 minute).." to ensure that if they turn
JavaScript off and switch pages it will still tell them they are not
logged in.

Evolt.org has a nice handful of articles on login/session systems:
http://www.evolt.org/node/60384

[Back to original message]