[RESOLVED] Problems with cookies

[reub77]

I've had this site running for quite some time error free. The host must have upgraded something and now my site's authenticating processes don't work. I've traced the problem to where I set some cookies as they aren't appearing as set when I retrieve them from another page. Here is the code where I set the cookies:

<?PHP 
//Connecting to database
include ("connectDB.php");
//if ($Submit){
    //Collect Form Data
    $username = $_POST['username'];
	$passWord = $_POST['passWord'];
	$save = $_POST['save'];
	//print "User: $username, Pass: $passWord, and Saved: $save";

if ($username != "" && $passWord != ""){
    function login($username, $passWord) {

        $conn = db_connect(); 
        $result = mysql_query("SELECT * FROM loginusers WHERE users='".$username."' AND password='".$passWord."'");
        if(mysql_num_rows($result)<1) {
	        // if query error
        setcookie("error", "Incorrect login attempt, please try again." );				
            Header("Location: index.php");
		}
        if(mysql_num_rows($result)>0) { 
            // if the values match values in the database 
            return("true"); 
	    } 
	    mysql_close();
    }          
    // now check the values received via the form 
    $result = login($username, $passWord);
    if($result == "true") { 
        // set //
		if($save == "Yes"){
        setcookie("siteuser", $username, time() + 60*60*24*30); 
        setcookie("passcode", $passWord, time() + 60*60*24*30);
		setcookie("save", Yes, time() + 60*60*24*30 );
		setcookie("error", "", time()-3600);
		}else{
		setcookie("siteuser", $username ); 
        setcookie("passcode", $passWord );
		setcookie("error", "", time()-3600);
		}

        // redirect //
        Header("Location: home.php");
    } 
}
else {  
	Header("Location: login.php"); 
	setcookie("error", "Incorrect login attempt, please try again." );	
}
//}
?>

And here is the page code that I use to retrieve the cookies:

<?PHP
if ($siteuser == "" || $passcode == "") {
  echo "<script language='javascript'>self.location='index.php';</script>";
  //Header("Location: index.php");
}
?>

If you see anything thats off or is not allowable anymore please let me know. I don't keep up on the latest coding as I'm a web designer.

Thanks!

[bradgrafelman]

Sounds like register_globals has been turned off - which is a good thing! Don't know why? Search the board (or even the manual itself) for the security vulnerabilities involved with register_globals.

You need to use the superglobal arrays explained on this manual page: [man]variables.predefined[/man]. For example, cookies are stored in the $_COOKIE array.

You use $_POST on the previous page, so I'm assuming you know what I'm talking about.

EDIT: Speaking of your script being wide open to security exploits, read up on MySQL injection attacks. You should never, ever, EVER put user-supplied data (e.g. from the $_POST array) directly into a SQL query. Instead, pass it through a function such as [man]mysql_real_escape_string/man first.

[reub77]

Sounds as though you have a good grasp as to my problem. And I see now how using user defined data could be potentially bad when querying the database. So my question to you is how do I use this function and how can i create super global variables? These may be very novice questions, I am a bit of a newbie. I need to see examples of usage before I can begin using the correct code.

[bradgrafelman]

reub77 wrote:

So my question to you is how do I use this function

Quite simple, really. You have this:

$username = $_POST['username']; 
$passWord = $_POST['passWord']; 

All you need to do is store the result of [man]mysql_real_escape_string/man instead of the actual $POST items themselves, so use something like this:

$username = mysql_real_escape_string($_POST['username']);
$passWord = mysql_real_escape_string($_POST['passWord']);

reub77 wrote:

...and how can i create super global variables?

I don't understand what you mean... you aren't creating them, you're using the superglobal predefined array $COOKIE to access the cookie... so instead of simply $username it'd be $COOKIE['username'] -- it works the same way as POST'ed data and the $_POST array.

[reub77]

I follow you now. Thanks for your help.