My question is about creating a secure log in routine. After comparing the user name and password to the stored values I set a session variable called logged to true. Then as the user surfs around the web page I just check the logged variable for true or false to determine if the user should have access.

This is my first time creating something like this. Is this secure? I feel like there is something else that I should be doing to make sure that users are valid.