Login with Cookie

[Anon]

Hi,
i've a question. I wrote a Forumsoftware w. PHP4/MySQL now i want to offer my visitors to log into this Forum via cookie. So, how can i write the Username and the Password of a user into a cookie? And how can i protect the password in the cookie?
Lots of questions :-)

Thank you

Manuel

[Anon]

How to set cookies is describe in the manual.

You should never store the password on the client side in a cookie, because
the password is only needed to let the user login.
When the user logs in, send a cookie containing some random generater
key that you can verify, but that changes every time the user logs in.

[Anon]

You don't even need to set a cookie with PHP4. Use sessions instead to login the user. Something like this:

<?php
$link;
connectToDB();
function connectToDB()
{
global $link;
$link = mysql_connect( "localhost", "jhyers", "careinx" );
if ( ! $link )
die ("Couldn't connect to MySQL" );
mysql_select_db ( "careinternet", $link )
or die ( "Couldn't open $db: ".mysql_error() );
}
function getRow( $table, $fnm, $fval )
{
global $link;
$result = mysql_query( "SELECT * FROM $table WHERE $fnm='$fval'", $link );
if ( ! $result)
die ( "getRow fatal error: ".mysql_error() );
return mysql_fetch_array( $result );
}
function newUser ( $username, $pass )
{
global $link;
$result = mysql_query( "INSERT INTO login (username, password)
VALUES('$username', '$pass')", $link);
return mysql_insert_id( $link );
}
function checkPass( $username, $password )
{
global $link;
$result = mysql_query( "SELECT id, username, password FROM login
WHERE username='$username' and password='$password'",
$link );
if ( ! $result )
die ("checkPass fatal error: ".mysql_error() );
if ( mysql_num_rows( $result ) )
return mysql_fetch_array( $result );
return false;
}
session_start();
session_register( "session" );
function cleanMemberSession ( $id, $username, $pass )
{
global $session;
$session[id] = $id;
$session[username] = $username;
$session[password] = $pass;
$session[logged_in] = true;
}
function checkUser( )
{
global $session, $logged_in;
$session[logged_in] = false;
$club_row = getRow ( "login", "id", $session[id] );
if ( ! $club_row ||
$club_row[username] != $session[username] ||
$club_row[password] != $session[password] )
{
header( "location: http://www.careinternet.net/login.php" );
exit;
}
$session[logged_in] = true;
return $club_row;
}
$club_row = checkUser();
?>

You could use some code like this in an include file and then write your login and register page.

Some people might have cookies disabled with all of the privacy stuff going on. And if all you need is a user login and password sessions will work fine and you don't even need cookies. PHP4 is great in that respect.

[Anon]

I followed the advice in Tim Perdue's column on authentication and added an md5 hash to my login routines. Basically I do this:

Ask the user for a username and password
select * from users where username='$usename'
compare passwords
on success:
create a PHP4 session
compute an md5 hash of the uid and a systemwide passphrase
session_register the username, uid, real name, and the md5 hash

Then, on all the protected pages, I restore the session variables, compute an md5 hash of the uid, compare it with the stored uid, and force-logout the user if there is any monkey business going on (i.e., somebody is trying to fake a uid).

[Anon]

Thanks for you help - but i've already an security system with session id and MD5 - only thing that i want to do with the cookie is that the visitor dont has to fill out the login form everytime he visits my site again.

[Anon]

Are you looking to restore the whole session automatically (seems like it might be a security issue) or just pre-fill-out the login screen with the user's name?

[Anon]

Just a prefilled-out form

[Anon]

In that case, it's no problem storing the username, just create a
cookie after they log it, but remember that the cookie has to
be created before you send any output:

setcookie( "_my_app_user_id", $data[4], 2147483647 );

This sets up '_my_app_user_id' as a cookie with a lifespan of 2^31-1
seconds, which is essentially permanent. The value is the user id
the just logged in with, and since I don't specify a domain it will
get sent back with every single page request from my site.

As far as the password--DON'T.

[Anon]

Thank you