Member Avatar for hwoarang69

let say i create session in login page. here session is on id and username.

$_SESSION["id"] = $id;
$_SESSION["username"] = $username_p;

now to see who loged in i can do this

$user_name_s = $_SESSION['username'];  //has the name of who is loged in

now how do i do this with cookies? how can i get the name of user who is loged in here. (not using sessions)

setcookie("id", $id, time()+172800); 
setcookie("username", $username_p, time()+172800); //seconds - 2 days
  • 2 Contributors
  • 1 Reply
  • 117 Views
  • 45 Minutes Discussion Span
  • Latest Post Latest Post by Member #949455

Dani AI

Generated

Short answer: the client-side cookie value is available in PHP via $_COOKIE (for example, check isset($_COOKIE['username']) and escape it before output). Note that setcookie() only sends a header — the value will appear in $_COOKIE on the next request, not immediately.

Security note tied to : taking raw values from $_POST and writing them back into cookies (or trusting cookie values for auth) is unsafe. Cookies live on the client and can be tampered with, so they must never be treated as an authentication source by themselves. Authentication should be based on server-side validation; cookies may store a session id or a securely constructed token that the server verifies.

A recommended pattern for a "remember me" cookie (summary):

  • After successful login, generate a random selector and validator.
  • Store the selector and a hashed validator plus user id and expiry in the database.
  • Set a cookie containing the raw selector and raw validator (or split them into two cookies). Use HttpOnly, Secure, and SameSite flags and a reasonable expiry.
  • On a returning visit, look up the selector in the DB, verify the validator using password_verify() or a constant-time comparison, and if valid re-create the session and rotate the token (issue a new validator).

Example snippets (illustrative):

$username = isset($_COOKIE['username']) ? $_COOKIE['username'] : null;
echo htmlspecialchars($username, ENT_QUOTES, 'UTF-8');
$selector = bin2hex(random_bytes(9));
$validator = bin2hex(random_bytes(33));
$hashed = password_hash($validator, PASSWORD_DEFAULT);
// store $selector, $hashed, $userId, $expiry; set cookie with $selector.':'.$validator

Further reading and concrete API details: see the PHP cookie docs (setcookie, $_COOKIE variables) and the OWASP guidance for authentication/session management (Authentication Cheat Sheet). Additional safeguards: do not store passwords in cookies, regenerate session id after login, and always sanitize before echoing cookie contents.

Member Avatar for Member #949455

now how do i do this with cookies? how can i get the name of user who is loged in here. (not using sessions)

Instead of this:

setcookie("id", $id, time()+172800);
setcookie("username", $username_p, time()+172800); //seconds - 2 days

Try this:

setcookie("id", $_POST['id'], time()+172800);
setcookie("username", $_POST['username'], time()+172800); //seconds - 2 days
commented: To Rectify what some retard did to LastMitch +0
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.