"hash" to cookie

[wkilc]

:o
I'm probably well over my quota for forum posts in a month... but I promise this is my last one for a while because I've got everything else working now...

After verifying a username and password for login to my member's section, I check for the "remember me" option, and if it's been 'ticked', the cookie is set with member's user name:

if(isset($_POST['remember'])){
      setcookie("cookname", $_SESSION['user'], time()+60*60*24*100, "/");

...then on my "member" pages, I first check for an active session, not there, then I check for this cookie. First to see if it exists, and then to retrieve the member's username and verify said username againast a DB and verify that she/he's still a member. ("Remember me" cookie lives for a year, but memberships can technicallly expire before then.)

if (isset($_COOKIE['cookname'])) {      

   $_SESSION['user'] = $_COOKIE['cookname'];
}

   $user   = $_SESSION['user'];

$sql = "SELECT user
        FROM users
        WHERE user = '$user'";

$result = mysql_query($sql) or die('Query failed. ' . mysql_error());

if (mysql_num_rows($result) == 1) {
    // the user id is verified,
    // set the session
    $_SESSION['logged_in'] = true; 

I've been advised to add "hash" or "md5" to this cookie for security.

That makes sense... but my question is this... and please remember that I'm a total n00b, if the username is encrypted when it's stored in the cookie, how can I retrieve it and check it against the DB later on?

Just messing around with it... I've tried:

      setcookie("cookname", md5($_SESSION['user']), time()+60*60*24*100, 

...and this gives me a parse error.

Thanks.

[thorpe]

you pull the value from the cookie (which is encrypted when created), then pull the value from the database. you then md5 the value from the database and compare it to the (md5'd) value from the cookie.

[wkilc]

Thank you once again thorpe... I'm gonna have to bake you some cookies down the road. 🙂

Can you possibly tell how to md5 this:

$_POST['user'] = stripslashes($_POST['txt_user']);
$_SESSION['user'] = $_POST['txt_user'];  

setcookie("cookname", $_SESSION['user'], time()+60*60*24*100,  

Because I've learned that this gives me a parse error:

setcookie("cookname", md5($_SESSION['user']), time()+60*60*24*100, 

this prevents the cookie from being set:

setcookie("cookname", $_SESSION[md5('user')]), time()+60*60*24*100, 

Many thanks.

[thorpe]

no parse errors here.

setcookie("cookname", md5($_SESSION['user']), time()+60*60*24*100);

[wkilc]

Whoops... you're right... not sure what I was doing wrong... but I got that same result a couple of times... workin' fine now. Viewing the cookie in FireFox I can see that it's encoded.

Now when I check for the cookie's value against the database:

if (isset($_COOKIE['cookname'])) {      

   $_SESSION['user'] = $_COOKIE['cookname'];
}

   $user   = $_SESSION['user'];

$sql = "SELECT user
        FROM users
        WHERE user = '$user'";

$result = mysql_query($sql) or die('Query failed. ' . mysql_error());

I tried:

if (isset($_COOKIE['cookname'])) {      

   $_SESSION['user'] = $_COOKIE['cookname'];
}

   $user   = md5($_SESSION['user']);

$sql = "SELECT user
        FROM users
        WHERE user = 'md5($user)'";

$result = mysql_query($sql) or die('Query failed. ' . mysql_error());

... but it boots me back to my own login page... so no match there.

I think that it's because the I'm still comparing the md5 value in the cookie to a non-encrypted value in the DB... but I'm not sure how to correct that.
Can't do this, can I?

WHERE md5(user) = '$user'";

Thanks once again.

[wkilc]

It actaully occured to when I was away from the computer last night... I was md5'ing the already md5'ed value in the cookie.

The solution was (at least, I think this is the best way to do it):

 if (isset($_COOKIE['cookname'])) {      

   $_SESSION['user'] = $_COOKIE['cookname'];
}

   $user   = $_SESSION['user'];

$sql = "SELECT user
        FROM users
        WHERE md5(user) = '$user'";

$result = mysql_query($sql) or die('Query failed. ' . mysql_error());  

Later.