Records Login Entries and Session State

Question

How can I record the login entries and session state? I've search for source codes and ideas but I can't understand some of it. I want to ask a simple code through PHP. I have a code that can login user but does not need MySql database, and I want an idea how to RECORD LOGIN ENTRIES AND SESSION STATE connecting my PHP Login code. Or if you have other option code that need MySql database.

Here's the code:

"CONFIG.PHP"

<?php
$user = "admin";
$pass = "password";
?>

"INDEX.PHP"

<?php
include("config.php");

// Check form if is submited
if(isSet($_POST['trimite'])) {
// Check if user is equal with username and  password from config.php
if($_POST['user'] != $user || $_POST['pass'] != $pass) {
echo "Sorry, your data is invalid";
} else {
// Open the session for store user logged
session_start();
// Setting the session
$_SESSION['logat'] = "da";
// Redirecting user to admin page if is logged
Header('Location: admin.php');
}
} else {
// Form
echo '<form action="" method="post">
Username: <input type="text" name="user">
Password: <input type="password" name="pass">
<input type="submit" name="trimite">
</form>';
}
?>

"ADMIN.PHP"

<?php
include("config.php");
// Start session
session_start();

// Check if user is logged and existing session
if(isset($_SESSION['logat'])) {
// Content for user logged
echo "Welcome ".$user." :) - <a href='logout.php'>Logout</a>";
} else {
// Redirecting to login page
Header("Location: ./");
}
?>

Answer 1

Always put session_start() as the very first statement after <?php

It is okay to run session_start() even if the user is not logged in. session_start() should be the first statement.

Note that the header() command requires a lowercase h (not Header - that is wrong).

index.php

<?php
    session_start();
    include("config.php");

    // Check form if is submited
    if( isSet($_POST['user']) ) {
        // Check if user is equal with username and  password from config.php
        if($_POST['user'] != $user || $_POST['pass'] != $pass) {
            echo "Sorry, your data is invalid";
        } else {
            // Open the session for store user logged
            // Setting the session
            $_SESSION['logat'] = "da";
            $_SESSION['username'] = $_POST['user'];
            // Redirecting user to admin page if is logged
            header('Location: admin.php');
        }
    } else {
        // Form
        $out = '
            <form action="" method="post">
                Username: <input type="text" name="user">
                Password: <input type="password" name="pass">
                <input type="submit" name="trimite">
            </form>
        ';
        echo $out;
    }
?>

admin.php -- Here is how to reference/use the username session variable:

<?php
    // Start session
    session_start();

    include("config.php");

    // Check if user is logged and existing session
    if(isset($_SESSION['logat'])) {
        // Content for user logged
        echo "Welcome ".$_SESSION['username']." :) - <a href='logout.php'>Logout</a>";
    } else {
        // Redirecting to login page
        header("Location: ./");
    }
?>

---

Note that header can only be used if no data has been sent to the DOM yet. Sometimes that is very difficult to prevent. Here is an HTML tag that allows you to redirect to another page:

<meta http-equiv="refresh" content="0;url=http://example.com">

The number zero (before url= means the number of seconds to wait before redirecting the page.