title: Prevent user access PHP page directly
body: <p>I have a production public e-commerce website that are dealing with real currency. I want only logged in user (authorized) to view and use the function. </p>
  
  <ol>
  <li><p>Are there any potential vulnerability where any person directly call <strong>www.mywebsite.com/get_content.php?abc</strong> thus calling the function within? </p></li>
  <li><p>Also, is my current coding method sufficient? Please provide the best guidelines to follow for production e-commerce website.</p></li>
  </ol>
  
  <p>I am really new to PHP and would like to implement security in it.</p>
  
  <p><strong>Product.php</strong> &lt;-accessible through navbar</p>
  
  <pre><code>&lt;?php
      include 'start_session.php';
  ?&gt;
  &lt;html&gt;
  &lt;head&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;div class="container"&gt;
      &lt;?php
          include 'get_content.php';
      ?&gt;
  &lt;/div&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p><strong>start_session.php</strong> &lt;-A PHP within <strong>Product.php</strong>. Duplicate across other page</p>
  
  <pre><code>&lt;?php
      session_start();
  ?&gt;
  </code></pre>
  
  <p><strong>get_content.php</strong> &lt;-A PHP page only for <strong>Product.php</strong> for easy readability and maintain</p>
  
  <pre><code>&lt;?php
  function abc(){
      //do something
  }
  
  if((isset($_SESSION['user_id']))){
      //connect db and get content
  }
  ?&gt;
  </code></pre>