Store the authenticated account’s stable ID in $_SESSION, start that session before any output on every page that needs it, and use the ID to load the user’s name. Escape the name when placing it in HTML. The same server-side identity must determine comment authorship; a hidden form field is not trustworthy.
Use one session key for the authenticated account
A PHP session connects separate HTTP requests through a session identifier. After a successful login, save the account ID under one descriptive key—such as user_id—and use that exact key throughout the site.
As an Amazon Associate I earn from qualifying purchases.
<?php
// Run after the password has been verified successfully.
session_regenerate_id(true);
$_SESSION['user_id'] = (int) $user['id'];
Call session_regenerate_id(true) when authentication elevates the visitor’s privileges. PHP’s session-security guidance also recommends using strict session mode and configuring secure cookie options for the deployment.
Recommended Free Tools
Start the session before page output
Every page, controller, or shared header that reads login state must resume the session before sending HTML, whitespace, or other output. A shared bootstrap prevents pages from drifting apart:
#1 Best Overall
<?php
session_start();
$username = null;
if (isset($_SESSION['user_id'])) {
$stmt = $conn->prepare('SELECT username FROM users WHERE id = ?');
$stmt->bind_param('i', $_SESSION['user_id']);
$stmt->execute();
$user = $stmt->get_result()->fetch_assoc();
$username = $user['username'] ?? null;
}
This example assumes $conn is an existing MySQLi connection and that users.id is an integer. Bind according to the actual column type. Prepared statements keep the session-derived value out of interpolated SQL and should also be used for inserts and other request data.
Render the name safely in the template
<?php if ($username !== null): ?>
<p>Welcome, <?= htmlspecialchars(
$username,
ENT_QUOTES | ENT_SUBSTITUTE,
'UTF-8'
) ?></p>
<?php else: ?>
<p>You are not signed in.</p>
<?php endif; ?>
htmlspecialchars() prevents account text from being interpreted as HTML in this output context. Keep the encoding explicit and apply context-appropriate escaping if the value is later placed in JavaScript, a URL, or an HTML attribute.
Apply the pattern to a shared site header
Include the bootstrap before the common navigation on pages such as advisory.php, profile pages, and dashboards:
Rank #2
<?php require __DIR__ . '/bootstrap.php'; ?>
<nav>
<?php if ($username !== null): ?>
<span>Signed in as <?= htmlspecialchars(
$username,
ENT_QUOTES | ENT_SUBSTITUTE,
'UTF-8'
) ?></span>
<a href="logout.php">Log out</a>
<?php else: ?>
<a href="login.php">Log in</a>
<?php endif; ?>
</nav>
Including one initialization file gives every relevant page the same session startup, database lookup, and variable names.
Choose how to obtain the display name
| Approach | Freshness | Database work | When it fits |
|---|---|---|---|
Store only user_id; query the name when needed |
Reflects a username change on the next lookup | One read on requests that display the name | Best when the ID is the canonical identity and names may change |
Store user_id and a display name in the session |
Can remain stale until the session value is refreshed | Avoids the read for pages that only need the cached name | Useful when the application explicitly accepts session-cached profile data |
Keeping the ID as the authoritative session value makes authorization checks independent of a mutable display name. If a cached name is used, update it whenever the account name changes.
Set the comment author on the server
Do not trust a form field such as <input type="hidden" name="author" value="Anonymous">. Visitors can edit hidden inputs before submitting them. In the POST handler, derive the author from the authenticated session and insert the message with a prepared statement:
<?php
session_start();
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!isset($_SESSION['user_id'])) {
http_response_code(401);
exit('Please log in to comment.');
}
$userId = (int) $_SESSION['user_id'];
$message = trim($_POST['message'] ?? '');
$stmt = $conn->prepare(
'INSERT INTO comments (user_id, message) VALUES (?, ?)'
);
$stmt->bind_param('is', $userId, $message);
$stmt->execute();
}
When displaying a comment, join the account record or resolve its name by the stored user ID. If anonymous posts are intended, implement that as an explicit server-side policy rather than accepting a client-supplied author identity.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Fix the common failure modes
The page prints a number instead of a name
The session value probably contains the account ID. An ID is not a username; query users.username by that ID before rendering.
$_SESSION['username'] is empty
The login code may only assign $_SESSION['account'] or another key. Either read the existing key consistently or assign a username deliberately after authentication. Prefer one canonical key name, such as user_id, across login, page initialization, and logout.
Rank #4
The session is unavailable on some pages
Check that session_start() runs before output on every page that needs identity and that all pages use the same session configuration and cookie scope.
The name lookup fails
Verify that the account still exists, that the bound parameter type matches the database column, and that the query result is checked before reading username. Treat a missing account as signed out or as an application error according to your policy.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesLogin failures redirect unpredictably
Do not use $_SERVER['HTTP_REFERER'] as a trusted redirect destination. Send failures to a fixed or allowlisted URL and display the error there.
Password verification uses an obsolete hash
Verify stored password hashes with PHP’s password APIs, including password_verify(), rather than regressing to MD5. The session should be populated only after verification succeeds.
Logout and session boundaries
Logout should clear the authenticated state and invalidate the session according to the application’s session policy. At minimum, remove the user ID before redirecting to a fixed destination. Pages must check for the key rather than assuming that a previously rendered header means the visitor is still authenticated.
Quick Recap
Implementation checklist
- Start the session before any output on every relevant request.
- Store a stable account ID after successful password verification.
- Use the same session key everywhere;
user_idis clearer thanaccount. - Load the username with a parameterized query, or consciously accept a cached session name.
- Escape the name with HTML-context encoding before rendering it.
- Derive comment authorship from the session, never from a hidden input.
- Regenerate the session ID after login and follow the deployment’s cookie-security settings.
- Use fixed or allowlisted redirect destinations instead of trusting the referrer header.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
