title: Allowing admin to login as any user using sessions
body: <p>I have a user login system in place.  I am starting to create the admin area and would like to allow a logged in admin to login as any user (in a new browser window).  I already have a username/password system setup for each and am using sessions to store some data. I guess I didn't think this through a whole lot in the beginning as now I am kind of stuck on how to go about this.</p>
  
  <p>After successful login of either I am storing info in <code>$_SESSION['account']</code> and using this as my main check if they are logged in or not on pages... <code>if(!$_SESSION['account']){...send to login page...}</code></p>
  
  <p>Users have one session and the admin has another.  I did this so the admin and the admin logged in as a user would be separate.  If I am logged in as admin and logged in as a user the session values of each do not interfere.... I can log out of the admin and stay logged in as a user and vice versa.</p>
  
  <p>Now, I can't seem to figure out how to allow the admin to login as a user.  I was going to do a dropdown list, select a username, and open a new browser window as the logged in user.  Since I am using different sessions this is posing a problem, but the sessions must be different so they don't interfere.</p>
  
  <p>Someone must have run into this situation before... any ideas?</p>
  
  <p><strong>admin :</strong></p>
  
  <pre><code>// start the session and timer
  session_name('Site_Admin');
  session_set_cookie_params(0, '/', '.test.com', false, true);
  session_start();
  </code></pre>
  
  <p><strong>user :</strong></p>
  
  <pre><code>// start the session and timer
  session_name('Site_Login');
  session_set_cookie_params(0, '/', '.test.com', false, true);
  session_start();
  </code></pre>
  
  <p><strong>EDIT:</strong></p>
  
  <p>I thought this through some more and here is the logic I came up with.  I will no longer be using two sessions, but rather one <code>session_name('Site_Login');</code></p>
  
  <p>When users login they have account info (first name, last name, id, username, email, etc that is often used) stored in <code>$_SESSION['user']</code>.  The admin on the other hand has information stored in <code>$_SESSION['admin']</code>.  Users and admins have access to totally different areas of the site and the session variables are completely different.</p>
  
  <p>With this setup I can then do checks on each page for correct access as I was before :</p>
  
  <pre><code>if(!$_SESSION['user'])
  {
      Header("Location: /"); //user login page
      exit;
  }
  
  or for admin pages
  
  if(!$_SESSION['admin'])
  {
      Header("Location: /admin/"); //admin login page
      exit;
  }
  </code></pre>
  
  <p>Also, since I am using the same session now... if I am logged in as an admin all I need to do is set <code>$_SESSION['user']</code> to whatever user I want to login as that user on user pages.  In the admin area I can do my dropdown, set the sessions variables for the user, and open a new page in the user area.  Logout of user and logout of admin are handled properly by <code>unset($_SESSION['user']);</code> and <code>unset($_SESSION['admin']);</code> rather than destroying the entire session as I was previously.</p>
  
  <p>If anyone sees any flaws with this logic please add comments.</p>