How to protect admin pages?

But only those controllers that will display admin pages should check if the user is logged in, and no need for those controllers that simply display blog entries. I mean I should have separate controllers, right?

You're welcome! You can make your checks as complex as you want and you don't necessarily need separate controllers if they do basically the same thing. You can develop a system of permissions, where different kinds of users can do different things.

But if you're going to go for levels of permissions, you might as well look into existing libraries that handle authentication, like "flexi auth." Otherwise, do as you say, and only check where necessary. 

Hey, don't work without a PHP debugger. Several free IDEs have this features built in. Two are NetBeans and CodeLobster. Without a debugger, it's like you're driving with a blindfold on -- you are going to crash!