Hi!

I'm building a login system for my application, but I'm having a little problem... It really needs top security, so I'm using both MySQL backend and cookies.

Example:
LOGIN FORM > VALIDATION > INSERT SECURE SESSION ID INTO DATABASE > STORE COOKIE WITH INFORMATION

That's for the login. For the authentication, I demand more than the "s" (for session) variable in the URL - that will only be any good combined with the cookie. So here's the authentication scheme, when the user enters a page:

CHECK FOR "S" VARIABLE if it exists > CHECK FOR A RECORD OF THE "S" ID IN DATABASE (with some extra security, but that one works and it's a secret :) ) if it exists > CHECK FOR "S" IN COOKIE > FETCH USERNAME FROM COOKIE; MATCH WITH SESSION > FETCH USER INFORMATION FROM COOKIE

However, I need to store several variables into the user's cookie. I have them in an array, and I'd like to store them like phpBB does. I think they use the PHP serialize() function. However, when I decode the cookie with some regular decoder, here's what I get:

****** [I](cookie name)[/I]
s:12:\"1r. Benedict\";
*******.*******.***/******/ [i](address)[/i]
1536
1389618816
29709504
748388000
29709500
*

Here's the code:

function verifylogin() {
	cnt();
	echo("<!-- Connected to database -->\n");
	$user = $_POST['userName'];
	echo("<!-- Obtained username: '".$user."' -->\n");
	$pass = $_REQUEST['password'];
	echo("<!-- Obtained password: 'big secret ;)' -->\n");
	$pass = [it gets encrypted here];
	echo("<!-- Password has been encrypted! -->\n<!-- Starting queries... -->\n");
	$q = "SELECT * FROM ".DBPREF."members WHERE membername = '".$user."'";
	$q = mysql_query($q);
	echo(mysql_error());
	if(mysql_num_rows($q) == 0) { /*There's no such user*/
		echo("<!-- Não digas a ninguém, mas o problema é a falta do username :P -->\n");
		dologin("<b>Erro de login</b><br>As informações introduzidas não estão correctas.<br>");
	} else { /*OK... username exists, check password*/
		$row = mysql_fetch_array($q);
		if([security routine, based on !=]) { /*we have a wrong pass*/
			echo("<!-- Não digas a ninguém, mas o problema é a palavra-passe errada :P -->\n");
			dologin("<b>Erro de login</b><br>As informações introduzidas não estão correctas.<br>");
		} else { /*damnit... no error screens will b displayed, cos the info is right :P */
			echo("<!-- OK, temos informações válidas :@ Não deu para chatear desta vez :@ -->\n");
			$sess = [generating secure session id];
			mysql_query("DELETE FROM ".DBPREF."sessions WHERE member = '".$user."'"); /*delete old sessions*/
			$q = "INSERT INTO ".DBPREF."sessions (member, shash, started, ip_address, browser) VALUES ('".$user."', '".$sess."', '".time()."', '".$HTTP_SERVER_VARS["REMOTE_ADDR"]."', '".$HTTP_SERVER_VARS['HTTP_USER_AGENT']."')"; /*both ip and browser agent don't work, but nevermind that for now*/
			$q = mysql_query($q);
			if($q == false) { /*wot?! we couldn't insert the session! it doesn't ever happen, but i'm preventing :D*/
				echo("<!-- ALERTA! NÃO PODE SER INSERIDA A SESSÃO NA BASE DE DADOS. -->\n<!-- ".mysql_error()." -->\n");
				globalerror("<b>Falha do sistema.</b><br>Por favor <a href='mailto:suporte@gsantos.webvila.com?subject=DevNET - Erro&body=".mysql_error()."'>contacte-nos</a>.");
			} else { /*session row inserted into db*/
				echo("<!-- Sessão inserida na base de dados: ".substr($sess,0,16)."XXXXXXXXXXXXXXXX -->\n");
				echo("<!-- Iniciando obtenção de informações -->\n");
				/*fetch member info*/$member = getinfo($user);
				echo("<!-- Colocando informações em cookie... Username: '".$member['name']."' -->\n");
				$member['session'] = $sess;
				/*THIS IS WHERE IT DOESN'T WORK!!!*/setcookie("devnet", addslashes(serialize($member)), time()+1800);
				echo("<!-- Teste de cookie:\nUsername: '".$HTTP_COOKIE_VARS[$member['name']]."'\n-->\n");
				doredirect("Por favor aguarde...", "Você encontra-se agora identificado", DEVNET_URL."/?s=".$sess);
			}
		}
	}
}

function getinfo($member) {
	$q = mysql_query("SELECT membername,associated_website FROM ".DBPREF."members WHERE membername = '".$member."'");
	$m = mysql_fetch_array($q);
	$member['id'] = $m['id'];
	$member['name'] = $m['membername'];
	$q = mysql_query("SELECT * FROM ".DBPREF."websites WHERE id = ".$m['associated_website']."");
	$w = mysql_fetch_array($q);
	$member['website'] = $w['title'];
	$member['website_url'] = $w['url'];
	if($w['owner'] != $member['id']) {
		$t = mysql_query("SELECT membername FROM ".DBPREF."members WHERE id = ".$w['owner']."");
		$r = mysql_fetch_array($t);
		$member['boss'] = $r['membername'];
	}
	return $member;
	unset($q,$m,$w,$t,$r);
}

Can you help me please? Thanks

can you explain a little more of how you want your cookie to come back
$cookie[0] = 1536;
$cookie[1] = 1389618816;
$cookie[2] = 29709504;
is that what you mean?

if so look at the explode function
http://php.he.net/manual/en/function.explode.php

$cookie = explode(" ", $_COOKIE[someCookie']);

this will split into array where all the items are seperated by a space

$cookie = explode("\n", $_COOKIE[someCookie']);

whis will use the end of line character, or even use \r\n for linux computers

if you want to break it up into a named array use the list function
http://php.he.net/manual/en/function.list.php

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.