Does Not Create Cookie!!

mswags

Hi all,
I have been trying to figure this problem out for like 2 days now...yes, too long.

My code will NOT create a cookie. I am simply trying to create a login area. Here is my html code:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>News Login</title>
<link href="news.css" rel="stylesheet" type="text/css" />
</head>
<body>
<br /><br /><br /><span class="error"><center><? echo("$_GET[message]"); ?></center></span><br /><br />
<center>
  <form name="login" action="auth_user.php" method="post">
    <table>
	  <th colspan="2">Log in to Hailey's News</th>
      <tr><td>Username:</td><td><input name="username" type="text" /></td></tr>
      <tr><td>Password:</td><td><input name="password" type="password" /></td></tr>
      <tr><td><a href="create_account.html" target="_self">Create an account</a></td><td align="right"><input name="submit" type="submit" value="Log In" /></td></tr>
    </table>
  </form>
 </center>
</body>
</html>

And...my auth_user.php code:

<? import_request_variables('gpc');
   $dbh = mysql_connect("cgi.stu.aii.edu","aimstudent5","aimstudent5");
   mysql_select_db("aimstudent5");

   $query="select * ";
   $query.="from hmw_users ";
   $query.="where username = '$username' and ";
   $query.="password = '$password' and ";
   $query.="status = 'enabled'";

   $result = mysql_query($query);
   $row = mysql_fetch_array($result);

   if (isset($row[id])) {
     setcookie("user_id",$row[id], time()+36000);
	 header("Location: add_news.php");
	}
	header("Location: login.php?message=Login%20failed,%20please%20try%20again");   

?>

Then, I have the following snippet of code at the very top of my add_news.php page:

<?
  import_request_variables('gpc');
  $user_id = $_COOKIE['user_id'];
  if (!$user_id){
    header("Location:login.php?message=Please%20login%20before%20adding%20news");
  }
?>

Does anyone see anything that I am doing wrong??

Thanks,
mswags 😕

mswags

Another thing I should mention is that it works on one hosting server but not the one I want it to work on...

MarkR

Firstly:

Ensure that your servers (development AND production) have canonical host names. This means, there should be EXACTLY ONE host name which reaches your web site. You can have others, but set them up to redirect rather than serving the files.
Have a look at the HTTP headers and/or cookies in the browser - you may find the Mozilla extensions "Web Developer" and "Live HTTP headers" useful for this.
Doing what you're doing in the third script is ludicrously insecure:
You're using import_request_variables - Don't.
You're relying on sensitive data being in a cookie - USERS CAN MAKE UNAUTHORISED MODIFICATIONS.

It is possible to edit the value of a cookie (or indeed synthesise it). You should NOT store anything in there that is vulnerable to unauthorised modifications. You should only put an unguessable ID in there, nothing else.

Alternatively consider using sessions.

Mark