title: Need help implementing PHP sessions in suPHP
body: <p>I asked this question before <a href="https://stackoverflow.com/questions/9533150/is-there-any-security-with-suphp">here</a> but user <a href="https://stackoverflow.com/users/1820/cheekysoft">CheekySoft</a> pointed out that I was  "asking how to implement my <em>proposed solution</em>" where instead I should just "state my problem and ask for solution ideas". So here goes.</p>
  
  <p>On the linux server I have the files set up like so</p>
  
  <pre><code>/home
  ├──  user1
  │   ├── [-rwx------]  index.html
  │   └── [-rwx------]  index.php
  └──  user2
      ├── [-rwx------]  index.html
      └── [-rwx------]  index.php
  </code></pre>
  
  <p>If I have Apache virtual hosts set up at </p>
  
  <pre><code>&lt;Directory /home/user1&gt;`
  &lt;Directory /home/user2&gt;
  </code></pre>
  
  <p>Then [any] user can go to <code>www.example.com/user1/index.html</code> or <code>www.example.com/user2/index.html</code>. However, the permissions on those files are <code>0700</code>, therefore, they are inaccessible over the web. It is for this reason that I am using suPHP.</p>
  
  <p>For the sake of argument, lets say <code>index.php</code> has only the following in it</p>
  
  <p><strong>index.php:</strong></p>
  
  <pre><code>&lt;?php
  echo file_get_contents('index.html');
  exit();
  ?&gt; 
  </code></pre>
  
  <p>Now, with suPHP set up, user1 can go to  <code>www.example.com/user1/index.php</code> to view <code>index.html</code>. Likewise, user2 can go to  <code>www.example.com/user2/index.php</code> to view <code>index.html</code>. However, user1 can <strong>also</strong> go to <code>www.example.com/user2/index.php</code> to view user2's <code>index.html</code> page, and vice versa for user2.</p>
  
  <p>The natural way to deal with this is through <a href="http://net.tutsplus.com/articles/news/how-to-build-a-login-system-for-a-simple-website/" rel="nofollow noreferrer">PHP sessions</a>. All requests to a page are redirected to a main page (ie. <code>www.facebook.com</code>), the user is validated against the database, and then redirected to the correct page (see image below).</p>
  
  <p><img src="https://i.stack.imgur.com/oFDVa.jpg" alt="User Interaction diagram"></p>
  
  <p>The users would go to a page (ie. <code>www.example.com/page1.html</code>), and then there would be a portion of page 1 <strong>hard coded</strong> to ensure a valid session exists. If it exists, the page is loaded. If it does not exist, the user is redirected to, in this case, <code>index.html</code>. After they login and a valid session is established, they are redirected back to the original page. We can modify <code>index.php</code> to carry this out:</p>
  
  <p><strong>indexValidate.php:</strong></p>
  
  <pre><code>&lt;?php
  //this is purely pseudo code, I can't guarantee it will work
  session_start();
  require_once 'Session_Validator.php';
  $sv = new Session_Validator();
  $sv-&gt;validate($un, $pwd);
  
  echo file_get_contents('index.html');
  exit();
  ?&gt;
  </code></pre>
  
  <p>However, In my design, these pages (<code>page1.html</code>, <code>page2.html</code>...) are in the users own directory (<code>index.html</code>, <code>index.php</code>), therefore, the server can't demand that they have this hard coded section checking for a valid section. The user can simply edit the file to remove out this section. Of course this would be stupid on the user's part, but I don't want the user to have to modify every single one of their files to have a session check section at the top. I want this to be seamless. </p>
  
  <p>A few notes:</p>
  
  <ol>
  <li>I can use Apache to redirect <strong>all</strong> requests to a single <code>validateUser.php</code> script which, validates the user then, if valid, calls the original script requested. However, this has the side effect that suPHP has now already switched to a user, most likely <code>var-www</code></li>
  <li>I do not want to use <a href="http://www.yolinux.com/TUTORIALS/LinuxTutorialApacheAddingLoginSiteProtection.html" rel="nofollow noreferrer">Apache web login authentication</a></li>
  </ol>
  
  <p>Can anyone provide a solution to my problem?</p>