我如何写限制访问页面？

Question

I wrote custom login script for users to login to the main control page. I found out that even when users are not login they can still visit the main control of which I want someone to help me to write a restrict access to page().

Please look through my php login script and based on that code help me write the restrict access to the main control page. assume that my main crontrol page is: cecontrolpage.php

I know we use $_SESSION to that but I have little idea of it.

this is my login.php code which is working fine:

<?php
Session_start();
$Email       = $_POST["email"];
$Password    = $_POST["password"];
$cn          = "localhost";
$db_username = "root";
$pas         = "***";
$db_name     = "cemembers";
//Open a connection to a MySQL Server
if ($Email && $Password) {
    $connect = mysqli_connect($cn, $db_username, $pas, $db_name) or die("Could not connect to database");
    //sending MySqli query
    $query   = mysqli_query($connect, "SELECT * FROM users WHERE Email= '$Email'");
    $numrows = mysqli_num_rows($query);
    //After PHP declaration we are going to create index file[form]
    if ($numrows !== 0) {
        while ($row = mysqli_fetch_array($query)) {
            $dbEmail    = $row["Email"];
            $dbPassword = $row["Password"];
        }
        if ($Email == $dbEmail && $Password == $dbPassword) {
            header("location:ce membership birthday system control_pannel.php");
            @$_SESSION("Email") == $Email;
        } else
            header("location:index.php?login_attempt=1");
    } else
        header("location:index.php?login_attempt=2");
} else
    header("Location:index.php?login_attempt=0");
?>

please can someone help me write the php code to restrict access to cecontrol.php ??

Please STEP by STEP with php comments on each part.

Answer 1

First you have to save user values in session after authentication from database like
$_SESSION['username'] = "name"; $_SESSION['user_id'] = 1;

function check_session() {
                            session_start();
                            if ($_SESSION['user_id']=='')
                            {
                               // redirect to login 
                            }
                        }

On every page that you want to restrict access you can call check_session().