Advice - Passing Values from Validate page

[holty]

All

I have a login page where a user specifys a username and password.

These values are then passed to a php page that validates these details with those in a database.

If they pass, we are redirected to a page where a user can update information about themselves, if it fails - an error message is returned.

My problem is, if the validation is passed, what is the best way to pass the username through? surely if I append it to the end of the querystring, a user who has failed the login may try to access by putting there username on the end?

Any advice? maybe create a cookie? (how?)

[Nightfire]

If you want your users to log in everytime they visit the site, then you could use sessions, if you want them to stay logged in for x amount of time/days then you'll need to use cookies. If you have any problems then we'll help you out

[sad69]

I posted a link to a tutorial regarding this. Here is the link once again:

http://www.yeswebmaster.com/article.php?id=45

On the same subject, I wonder if anyone has any preferences as to whether to use the aunthentication through the headers (looks pretty cool, and you don't have to make a login screen -- done for you), or whether to create your login screen and all that stuff.

Also if anyone knows anything about the security issues between both methods, I'd like to hear your views. I'm going to be putting up a site that will need a login screen and most pages need to be secured by username/password, so I need to make a decision pretty soon...

Thanks,
Sadiq.