Michael,
My only question would be "Do you have an expiration date/time on the cookie?" On a public site you may not want one, but on a company site you need some way of making sure ex-employees can't log back in with a 'saved page' and a cookie.

Barbara

>Barbara;
>
>I wanted to make sure a user didn't have a shortcut to a page in the middle of my application. At most 'screens', I call CheckLogin() which grabs a UserID cookie created at login, checks it against a user table and uses SCATTER NAME objname to publish the user info to object properties, which can then be read by the calling function. If the calling function finds a blank objname.UserCode I know they're not properly logged in and I redirect them to the login screen.
>
>Every user in this app must register (available at the login screen), so it's pretty much like your session table I suspect - except I never clear it out.
>
>Please let me know if I did anything stupid or dangerous ....
>
>Thanks