Multiple Sessions

[deslyxia]

Good morning,

I am working on a php mysql project and have the following need. The main page is to be setup so that a doctor can login to his practice. Then it will go to a patient screen that will allow patients to login to their personal information within that doctors practice.

I already have it setup so that the doctor can login and it creates a session based on that login. I need to find a way to start a second session when the patient logs in ... or i need some guidance as to why i do not need to do that.

[Nullsig]

Why don't you have it so that the "Patient Session" is just built into the "Doctor Session"

Doctor Logs in to practice causing associated SESSION variables to be set. Then patient logs further into the system to access their personal records causing other SESSION variables to be set.

Once patient is done they log out of the system so that their information isn't accessible to others. You could also build in a 10minute timeout of the Patient level session variables so that if they forget they are still covered.

[deslyxia]

Why don't you have it so that the "Patient Session" is just built into the "Doctor Session"

If at the begining of each protected page i am using

Code: Select all

<?php
   require_once('auth.php');
?>

and my auth.php file looks like so..

Code: Select all

<?php
   //Start session
   session_start();
   
   //Check whether the session variable SESS_MEMBER_ID is present or not
   if(!isset($_SESSION['SESS_MEMBER_ID']) || (trim($_SESSION['SESS_MEMBER_ID']) == '')) {
      header("location: access-denied.php");
      exit();
   }
?>

How would i differentiate between a Doctor session on pages only protected for doctors and a Patient session where BOTH Patient and Doctor would need to be logged in at the same time?

[freshnet]

I'm not clear why you'd need both to be logged in at the same time, could you clarify a little what the page is supposed to do exactly?

[deslyxia]

The app i am building could be used in multiple practices by multiple physicians. When the URL loads there will be a login screen. This will allow the Doctor to login to his/her practice. From there they can load into the patient screen and allow their patients to login to their accounts. The key is that the patients need to be automatically tied to the Doctor. and since patients could conceivably see multiple doctors they could have multiple records in the system from different doctors ...

The way i was thinking of solving this was to have the DOctor and Patient login

[macek]

I think you don't know what the SESSION is and how it works :-)

It is per user / per PC / per CONNECTION variable. If I connect to your page I get some SESSION, if you load your page you get another SESSION.

So you only need one table with users (doctors and patients), table could be:

id | login | password | role (doctor/patient)

you will check login credentials posted by the form and then do

IF you are DOCTOR you cat do THIS
IF you are PATIENT you can do THAT

Understand?

[freshnet]

agreed, it sounds like you don't need sessions for this use case at all.

You don't really need to have another table either, you can use one table and have something like a 'doctor_flag' in the table. If that's set to 'true', the person can see all the records a doctor would see. Let me know if you need any help with the database design ;)