Okay I'll get straight to the point I was using a script to set cookies containing a username which someone could easily log-in just buy changing the $_GET variable in the address bar.
Now I've realised this horrible flaw in my script i've decided to set the cookies inside of my login script:
<?php
include("/home/tracdoor/public_html/login/database.php");
$username=$_POST['username'];
$password=$_POST['password'];
$username = stripslashes($username);
$password = stripslashes($password);
$username = mysql_real_escape_string($username);
$password = mysql_real_escape_string($password);
$sql="SELECT * FROM users WHERE username='$username' and password='$password'";
$result=mysql_query($sql);
$count=mysql_num_rows($result);
if($count==1){
$inTwoMonths = 60 * 60 * 24 * 60 + time();
setcookie('iHomeLogin', $username, $inTwoMonths);
header('Location:http://sam.exofire.net/members.php');
}
else {
echo "Incorrect username or password<br><br>Username supplied: $username";
}
?>
For some reason my cookies arn't being set does anyone know why this is?
