PHP Sessions

The session_start() function starts a new session or resumes an existing one.

<?php
session_start();

echo "PHP session started successfully.";
?>

Output: PHP session started successfully.

Call session_start() before sending HTML, whitespace, or other output to the browser when PHP needs to send session headers.

If your website already starts sessions in a shared header file, avoid starting the same session again without checking whether one is active.

<?php
if (session_status() !== PHP_SESSION_ACTIVE) {
    session_start();
}

echo "Session is ready.";
?>

This is a simple learning example demonstrating how session variables can represent a login state. It uses hardcoded demo credentials and is not a production authentication system.

<?php
session_start();

$error = "";

if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $username = $_POST["username"] ?? "";
    $password = $_POST["password"] ?? "";

    if ($username === "rahul" && $password === "demo123") {
        session_regenerate_id(true);

        $_SESSION["username"] = "Rahul";
        $_SESSION["logged_in"] = true;

        header("Location: dashboard.php");
        exit;
    } else {
        $error = "Invalid username or password.";
    }
}
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Session Login</title>
</head>
<body>

    <h2>Login Form</h2>

    <form method="post">
        <label for="username">Username:</label>
        <input type="text"
               id="username"
               name="username"
               required>

        <br><br>

        <label for="password">Password:</label>
        <input type="password"
               id="password"
               name="password"
               required>

        <br><br>

        <button type="submit">Login</button>
    </form>

    <p>
        <?= htmlspecialchars(
            $error,
            ENT_QUOTES | ENT_SUBSTITUTE,
            "UTF-8"
        ) ?>
    </p>

</body>
</html>

Demo credentials: username rahul, password demo123.

In a real application, retrieve users from a database, store password hashes using password_hash(), verify them using password_verify(), and use HTTPS with secure session-cookie settings.

Example dashboard.php

<?php
session_start();

if (empty($_SESSION["logged_in"])) {
    header("Location: login.php");
    exit;
}

$username = $_SESSION["username"] ?? "User";
?>

<h2>Welcome,
    <?= htmlspecialchars(
        $username,
        ENT_QUOTES | ENT_SUBSTITUTE,
        "UTF-8"
    ) ?>
</h2>

<p>You are logged in.</p>

<a href="logout.php">Logout</a>

The dashboard checks the session on the server before showing protected content. Use a consistent login filename and create a logout page to complete the exercise.