If you are writing an FBML app, then on every page of your app Facebook will pass a bunch of data in the query string of the page request. These parameters are all prefixed with fb_sig
, and make up the validation information for the user. You don't need to query the API at all.
When you instantiate the $facebook
object from the standard PHP client library, using something like $facebook = new Facebook('api key','secret key');
, the Facebook code automatically validates all these parameters for you and stores the result as part of the Facebook object.
As a result, you can simply do the following to determine if a user is logged in:
$facebook = new Facebook('api key','secret key');
$fbId = $facebook->get_loggedin_user();
If all the proper parameters were received, then you will get the user's Facebook id. I believe you get null
otherwise.
Note that if you are making an iframe app, there are other things to consider, as Facebook Connect will set cookies that may not necessarily expire when a user logs out of Facebook. The signature is always valid though, so if you get an id from get_loggedin_user()
, you can be sure that it's the right id.