为什么更好或更安全地检查用户是否登录

Question

I'm wondering about how do you normally check user session if the user try to login.

I use these three ways: Considering that the userid is the userid from a database. So it should be greater than 0 if a user logged in.

 //With empty() function
if(empty($_SESSION['userid'])){
    echo 'you are not logged in';
}


// Check if userid session is zero
if($_SESSION['userid'] == '0'){
    echo 'you are not logged in';
}

// Check if userid is lower than 1
if($_SESSION['userid'] < '1'){
    echo 'you are not logged in';
}

Are these okay or do you prefer another way?

doesn't isset() function return true even userid is 0?

Thanks.

Answer 1

The answer is: It doesn't matter. However, in terms of performance, you want this:

if (isset($_SESSION['userid']))

And you want to add protection to the session. Read https://www.owasp.org/index.php/Session_hijacking_attack