You think that I should set the session timeout in the config file itself? What do you think about also clearing the cache inside the config file as well? As long as stuff is stored in the cache memory then all the user has to do is hit the re-sumbit button then they are back in again. The other thing that I should mention too is that these users do not have system access.

I had another thought. You know how the browser stores forms, but you often still have to input your password even though the rest of the form info is saved? I probably just need to double check the password field to make sure that it is not empty. If my theory holds true, it should be empty if someone were to simply use the resubmit button.

I havent had a chance to look at the script a while since I started my new job, but I was thinking about it this morning. Its funny how you think about things when you leave them alone for a while. Ill have to double check that.

Not sure about books, but http://www.php.net/manual/en/ has helped me with most any php problem/question I've had. PHP has really good session handling, IMHO, and may be the way to do what you want (I've done something similar in the past using timestamp cookies instead of form fields...)