PHP and cookies (and milk!) - probably a simple error

Reply

Join Date: Apr 2006
Posts: 8
Reputation: mrcb is an unknown quantity at this point 
Solved Threads: 0
mrcb mrcb is offline Offline
Newbie Poster

PHP and cookies (and milk!) - probably a simple error

 
0
  #1
Sep 27th, 2009
So I have a simple login + set cookie script. After checking to see if the supplied credentials are in the db, the script sets a cookie. After this, the script forwards the user to a password protected page.

I know the login + cookie placing script works fine. When I try the wrong credentials it fails like it should and when I enter the right credentials it sets a cookie (i can see it in my cookies on my browser).

The problem comes when I try to read the cookies back to make sure a user is credentialed for a certain page.

Here is my cookie-reading part of the script:

  1. <?php
  2. $user = $_COOKIE['user']; //gets the user from the cookies
  3. $pass = $_COOKIE['pass']; //gets the pass from cookies
  4. include("connect.php"); // connects to our database
  5.  
  6. $login = mysql_query("SELECT * FROM members WHERE username='$user' AND password='$pass'") or die(mysql_error()); //selects info from our table if the row has the same user and pass that our cookies do
  7. if(!mysql_num_rows($login)) //if the username and pass are wrong
  8. {
  9. header("Location: index.php"); //redirects to our login page
  10. die(); //stops the page from going any further
  11. }
  12. ?>

And, for reference, this is the cookie placing part of the other script:

  1. if($count==1){
  2. setcookie("user", $myusername, time()+3600);//sets our user cookie
  3. setcookie("pass", $mypassword, time()+3600);//sets our pass cookie
  4. header("Location:../index_pinit.php");
  5.  
  6. }
  7. else {
  8. header("location:../oops.html");
  9. }

What am I doing wrong? Why can't I read the cookies back?
Reply With Quote Quick reply to this message  
Join Date: Sep 2007
Posts: 1,476
Reputation: cwarn23 has a spectacular aura about cwarn23 has a spectacular aura about cwarn23 has a spectacular aura about 
Solved Threads: 136
cwarn23's Avatar
cwarn23 cwarn23 is offline Offline
Nearly a Posting Virtuoso

Re: PHP and cookies (and milk!) - probably a simple error

 
0
  #2
Sep 27th, 2009
Try making this your second page and see if any header errors are reported when the cookies are set.
  1. if($count==1){
  2. setcookie("user", $myusername, time()+3600);//sets our user cookie
  3. setcookie("pass", $mypassword, time()+3600);//sets our pass cookie
  4. //header("Location:../index_pinit.php");
  5.  
  6. }
  7. else {
  8. header("location:../oops.html");
  9. }
Try not to bump 10 year old threads as it can be really annoying.
Like php then read my website at http://syntax.cwarn23.net/
Star-Trek-Atlantis - now that's what I call a movie ^_^
My favourite PC. - MacGyver Fan
Bad english note: dis-iz-2b4u
Reply With Quote Quick reply to this message  
Join Date: Sep 2009
Posts: 15
Reputation: haggis-man is an unknown quantity at this point 
Solved Threads: 1
haggis-man haggis-man is offline Offline
Newbie Poster

Re: PHP and cookies (and milk!) - probably a simple error

 
0
  #3
Sep 28th, 2009
Bear in mind that some users may choose to set their browsers to accept or decline cookie requests.

I don't have the whole picture from what you've entered but you may find that $_SESSION variables will do the job for you instead. They have super-global scope.
Reply With Quote Quick reply to this message  
Join Date: Sep 2007
Posts: 1,476
Reputation: cwarn23 has a spectacular aura about cwarn23 has a spectacular aura about cwarn23 has a spectacular aura about 
Solved Threads: 136
cwarn23's Avatar
cwarn23 cwarn23 is offline Offline
Nearly a Posting Virtuoso

Re: PHP and cookies (and milk!) - probably a simple error

 
0
  #4
Sep 28th, 2009
However sessions also use cookies unless you embed the sesssion id in the url.
Try not to bump 10 year old threads as it can be really annoying.
Like php then read my website at http://syntax.cwarn23.net/
Star-Trek-Atlantis - now that's what I call a movie ^_^
My favourite PC. - MacGyver Fan
Bad english note: dis-iz-2b4u
Reply With Quote Quick reply to this message  
Join Date: Sep 2009
Posts: 79
Reputation: Kruptein is an unknown quantity at this point 
Solved Threads: 5
Kruptein's Avatar
Kruptein Kruptein is offline Offline
Junior Poster in Training

Re: PHP and cookies (and milk!) - probably a simple error

 
0
  #5
Sep 28th, 2009
I would use sessions instead actually, they are more secure as cookies in my opinion, you can read all data cookies send in your browser, but sessions are a bit harder to read becuase they are encoded. They are actually encoded cookies, ...
Last edited by Kruptein; Sep 28th, 2009 at 6:39 am.
Reply With Quote Quick reply to this message  
Join Date: Sep 2007
Posts: 1,476
Reputation: cwarn23 has a spectacular aura about cwarn23 has a spectacular aura about cwarn23 has a spectacular aura about 
Solved Threads: 136
cwarn23's Avatar
cwarn23 cwarn23 is offline Offline
Nearly a Posting Virtuoso

Re: PHP and cookies (and milk!) - probably a simple error

 
0
  #6
Sep 28th, 2009
Originally Posted by Kruptein View Post
I would use sessions instead actually, they are more secure as cookies in my opinion, you can read all data cookies send in your browser, but sessions are a bit harder to read becuase they are encoded. They are actually encoded cookies, ...
I agree
Try not to bump 10 year old threads as it can be really annoying.
Like php then read my website at http://syntax.cwarn23.net/
Star-Trek-Atlantis - now that's what I call a movie ^_^
My favourite PC. - MacGyver Fan
Bad english note: dis-iz-2b4u
Reply With Quote Quick reply to this message  
Join Date: Apr 2009
Posts: 59
Reputation: Tekkno is an unknown quantity at this point 
Solved Threads: 1
Tekkno Tekkno is offline Offline
Junior Poster in Training

Re: PHP and cookies (and milk!) - probably a simple error

 
0
  #7
Sep 28th, 2009
So in your connect.php script, after your query, put something like:
  1. $_SESSION['user'] = $row['user'];
  2. $_SESSION['pass'] = $row['pass'];
Then in your login script, replace
  1. $user = $_COOKIE['user']; //gets the user from the cookies
  2. $pass = $_COOKIE['pass']; //gets the pass from cookies
With
  1. $user = $_SESSION['user'];
  2. $pass = $_SESSION['pass'];
Then in your logout script unset the session.
Reply With Quote Quick reply to this message  
Join Date: Sep 2007
Posts: 1,476
Reputation: cwarn23 has a spectacular aura about cwarn23 has a spectacular aura about cwarn23 has a spectacular aura about 
Solved Threads: 136
cwarn23's Avatar
cwarn23 cwarn23 is offline Offline
Nearly a Posting Virtuoso

Re: PHP and cookies (and milk!) - probably a simple error

 
0
  #8
Sep 28th, 2009
Originally Posted by Tekkno View Post
So in your connect.php script, after your query, put something like:
  1. $_SESSION['user'] = $row['user'];
  2. $_SESSION['pass'] = $row['pass'];
Then in your login script, replace
  1. $user = $_COOKIE['user']; //gets the user from the cookies
  2. $pass = $_COOKIE['pass']; //gets the pass from cookies
With
  1. $user = $_SESSION['user'];
  2. $pass = $_SESSION['pass'];
Then in your logout script unset the session.
I would never do it that way in case the session was somehow hacked. Instead only store the username in the session and validate the password with $_POST['pass'] . After that has been validated set $_SESSION['user'] to the username. Then to check if the person is logged in use if(isset($_SESSION['user'])) . But never store a password or even a hashed password in a session or cookie even though sessions are server side. It's just good practice.
Try not to bump 10 year old threads as it can be really annoying.
Like php then read my website at http://syntax.cwarn23.net/
Star-Trek-Atlantis - now that's what I call a movie ^_^
My favourite PC. - MacGyver Fan
Bad english note: dis-iz-2b4u
Reply With Quote Quick reply to this message  
Join Date: Sep 2009
Posts: 79
Reputation: Kruptein is an unknown quantity at this point 
Solved Threads: 5
Kruptein's Avatar
Kruptein Kruptein is offline Offline
Junior Poster in Training

Re: PHP and cookies (and milk!) - probably a simple error

 
0
  #9
Sep 29th, 2009
I agree with cwarn23
Reply With Quote Quick reply to this message  
Join Date: Jul 2009
Posts: 178
Reputation: codejoust is an unknown quantity at this point 
Solved Threads: 18
codejoust's Avatar
codejoust codejoust is offline Offline
Junior Poster

Re: PHP and cookies (and milk!) - probably a simple error

 
0
  #10
Sep 30th, 2009
I'd md5 the username and password (creating a 'key'), or hash the user email, and store that in the session instead of 1 using an unsecured cookie, or 2, using an unsecured username and password.
Beware that this method is very insecure and allows for SQL injection hacks. Run a mysql_real_escape on the query, or use the mysqli prepared statements feature to prevent this.
Reply With Quote Quick reply to this message  
Reply

Message:


Thread Tools Search this Thread



About Us | Contact Us | Advertise | DaniWeb | Acceptable Use Policy | RSS Feed

©2003 - 2009 DaniWeb® LLC