[RESOLVED] Cookie Setting Problem

[ClarkF1]

Is there any reason why this won't set the cookies?

Nothing is written to the browser before the cookies are set. This worked when I only had one lot of information in a password file, but now I've got more than one user it seems to be broke 😕 😕 😕

include("./config.php");
if(isset($_GET['act'])) {
  $act = $_GET['act'];
}
else  {
  $act = "null";
}

$pass="";

$read = fopen("tpassword.txt", 'r');
foreach($read as $line)
{
@list($id,$passwd,$su) = explode('|', $line);
if ($id == $_COOKIE['user']) 
{
$pass = $passwd;
break;
}
}

if(isset($_GET['act']) && ($act=="login"))  {
  $userid = $_POST['user'];
  $entered = $_POST['passwordx']; //put md5 back in
  $read = fopen("tpassword.txt", 'r');
  foreach($read as $line)
     {
        @list($id,$passwd,$su) = explode('|', $line);
        if ($id == $userid) 
        {
          if ($passwd = $entered) 
          {
            $cookiepass = $passwd; //put md5 back in
            setcookie('password', $cookiepass, 0, "/", $SERVER['SERVER_NAME'], 0); 
            setcookie('user', $userid, 0, "/", $SERVER['SERVER_NAME'],0); 
            echo "<script>window.location=\"testadmin.php\";</script>"; 
          }
          else
          {
          include ("./header.php");
          echo "Incorrect Password<br>";
          echo "<p><center><a href=\"testadmin.php\">Try again</a>";
          include ("./footer.php");
          die();
          }
        }
        else
        {
          include ("./header.php");
          echo "Username not recognised<br>";
          echo "<p><center><a href=\"testadmin.php\">Try again</a>";
          include ("./footer.php");
          die();
        }
    }
}

config.php just contains variable assignments.

[Ludichrist]

Looks like you set your cookies to expire as soon as you set them. Also, you're using $SERVER for the superglobal instead of $_SERVER.

[ClarkF1]

I hadn't spotted the $_SERVER problem. Thanks.

As for setting the cookie, setting the time to 0 creates a session cookie which gets deleted when the browser is closed. It does work because I've kept these lines and just moved their location in the script.

I use

setcookie('password', "", time()-60, "/", $_SERVER['SERVER_NAME'], 0);
setcookie('user', $userid, time()-60, "/", $_SERVER['SERVER_NAME'],0);

later on to delete the cookie if the user actively logs out.

[ClarkF1]

Should have done some better debugging.

 if ($passwd = $entered)

Should have been

 if ($passwd == $entered)

D'oh