Secure a "thanks" page against non-logged in users

Question

When a person registers on my site, or logs in, they are sent to "thanks.php".

The page checks is you're logged in or not and if so, tells you what you can do and if not, gives you a link to the register.php page.

However, anyone can make their own cookie and trick the script like that.

How do I protect myself from this?

One thing I thought of was checking if the $_SESSION['session_id'] is present in the database. Far as I know, you can't generate that yourself and even if you could, you'd need database access to find one out.

I'm not too sure however, does anybody have some advice or experience about this sort of "thanks" pages?

Answer 1

You cannot generate any Session Data or Database Data without having access to the server. So, a secure way to do this would either be set a SESSION cookie, with some variable, and check for that.

session_start();
$_SESSION['logged_in'] = true;


session_start();
if(!isset($_SESSION['logged_in']))
{
    header("Location: youarentsupposetobehere.com");
}

Answer 2

Well, yes, when people log in, you should NOT be setting a cookie that says loggedin=true or some such.

You should instead set $_SESSION['loggedin'] = TRUE PHP generally takes care of securing the cookies that manage that session automatically