Hi Dugawug - sorry for the late reply - It must have gone off the board.
Yeah, from what I've heard about these parts cookies will for some people, depending on the location of them to the server, expire the instant they're set, making them useless.
The best thing to do is put the server time inside the cookie and check that against the server's own time for expiry - here's a little test code I did that you might like.
Set the new cookie, then the time in it is valid for 2 seconds - keep refreshing and it'll say "no errors" then after 2 seconds the time will be invalid, and it'll tell you as much, then after the actual cookie lifetime has died it'll disappear altogether. So for a non-local server set the cookie lifetime to something huge, like a few days, not the six seconds I've put here. I've left my comments in as I faff up to myself so I know what they hell I was on about at the time
<?php
/* Ok I want to make a cookie that has an expire time value as piece of the data,
so I can say expire in 3 days time - and put in a unix time, then to check that
time hasn't been tampered with I need a checksum, an encryped value so I know it's valid
So the cookie would contain
username
expire time
checksum
See the problem? You could get your own valid expire time then throw in any username to get
access, so you have to account for that in the checksum, too.
*/
$cookie_errors=array( 0 => "NO ERRORS", 1 => "NO COOKIE", 2 => "TIME EXPIRED", 3 => "CHECKSUM BEFOULED");
$result=check_cookie();
if( @$_REQUEST['newcookie'] ) set_cookie();
if( @$_REQUEST['delcookie'] ) del_cookie();
echo "<br>RESULT: ".$cookie_errors[$result];
echo '<pre>';
print_r($_COOKIE);
echo '</pre>';
function check_cookie()
{
if( !isset($_COOKIE['user']) || !isset($_COOKIE['eTime']) || !isset($_COOKIE['checkSum']) )
{
return 1;
}
$user=$_COOKIE['user'];
$eTime=$_COOKIE['eTime'];
$checkSum=$_COOKIE['checkSum'];
$pass="pumpy";
$myCheckSum=md5( $eTime.md5($pass) );
if( $myCheckSum != $checkSum) return 3;
if( $eTime<time() ) return 2;
return 0;
}
function set_cookie()
{
if(@$_REQUEST['sessiononly'])
$cookiePhysLife=0;
else
$cookiePhysLife=time()+6;
$cookieExpire=2;
$name="Damo";
$pass="pumpy";
$expires=time()+$cookieExpire; // they expire in 15 seconds
$myCheckSum=md5( $expires.md5($pass) );
setcookie('user', $name, $cookiePhysLife);
setcookie('eTime', $expires, $cookiePhysLife);
setcookie('checkSum', $myCheckSum, $cookiePhysLife);
header("Location: $_SERVER[SCRIPT_NAME]"); exit;
if(@$_REQUEST['sessiononly'])
echo "TEMPOSS ";
echo "COOK COOK!!";
}
function del_cookie()
{
setcookie('user', "foo1", time()-100000);
setcookie('eTime', "foo2", time()-100000);
setcookie('checkSum', "foo3", time()-100000);
header("Location: $_SERVER[SCRIPT_NAME]"); exit;
}
?>
<form action="<?=$_SERVER['PHP_SELF']?>" method="post" enctype="application/x-www-form-urlencoded" name="form1">
<input name="newcookie" type="submit" id="newcookie" value="New Cookie">
<input name="delcookie" type="submit" id="delcookie" value="delete cookie">
<label for="sessiononly">session only</label>
<input name="sessiononly" type="checkbox" id="sessiononly" value="yes">
<a href="<?=$_SERVER['SCRIPT_NAME']?>">Reload</a>
</form>
