What I've done is have the login page, once the user's credentials are verified, set a session variable called "login_id", which is the auto_increment ID for that user's record in the user table.
When later pages issue sestion_start(), they can then check for the presence of $_SESSION["login_id"] to know whether the user is correctly logged in, and use that variable's value to know who the user is. Conversely, if the variable does not exist, other pages can redirect the browser to the login page.
______________________________________________________________________
TANSTAAFL!