🔒 Locked

PHP not writing cookie...

Started by Toolmaker Feb 26, 2004 at 9:21 AM 10 replies 1.1k views

Original Post

Feb 26, 2004 at 9:21 AM

My site needs rewriting, so every now and then I add a little to it. I am doing my login screen now but for some reason I cannot write my cookie. After looking up the code on the PHP site I found out that I need to write my cookie before sending the HTML headers. So, this is my code now:

// Function definitions and require_once() calls

    // Begin normal script execution, by grabbing action and the username/password

    $action = $_POST["action"];
    $username = $_POST["username"];
    $password = $_POST["password"];   
    
    // Write cookie with username/password

    WriteCookie($username, $password);
    ?>
    
    <!-- Send HTML headers -->
    <html>
        <header>
            <title>
            </title>
        </header>

        <body>     
    <!-- End HTML headers -->   
    
    <?php        

    if ($action == "login")
        Login($username, $password);
    else
        ShowLogin();
?>

The code for WriteCookie is this:

    function WriteCookie($User, $Pass)
    {
        $Array = array($User, $Pass);
        $CookieText = implode(":", $Array);
        $Ret = setcookie("ToolmakerSoft", $CookieText, time()+36000);
        return $Ret;
    }

Why doesn''t my cookie get written? Toolmaker

-Earth is 98% full. Please delete anybody you can.

Prozak

Feb 26, 2004 at 9:53 AM

Create a new php page with only this code and try it out:

<?php
$Ret = setcookie("ToolmakerSoft", "SomeValue", time()+31536000);
?>

31536000 stands for a full year (365 days).

Dont even have a space before the code, or it wont work, it has to be the absolute first thing on the page (although it can be the last dinamic thing, if you dont send any headers before).

That should work. Maybe your code isnt working because the server time is diferent from the local user time? dont know...

Note: Dont put the user's nick and password on the cookie, that is bad design, and a possible security liability. What I do is generate a unique 24 char string of upcase and lowcase letters, and numbers, which equals something like:
10.408.797.222.153.400.000.000.000.000.000.000.000.000.000 diferent possibilities... (62^24)

You save this string in the cookie, and in the user table, then, when the user accesses your website, you retrieve the cookie value, and do a select from the database for it.

Question: I not use the user's table unique id, like "2" or "15"?
- Cause I (the user & possible hacker) could go into the cookie and change the value from "15" to "1", and the website would believe im another user, and maybe even one with admin capabilities, but no hacker can guess an admin's or another user's unique 24 char string...

Another rule of thumb is to authenticate admins, in other words, if an admin is about to perform an action on the website that is limited to admins only, then he should be validated, the website should make sure that the person sitting in front of the computer is the "real" user and not some hacker.
So the website asks for the user's password+nick. Once entered correctly, the website sets a session variable, "authenticated" for example, as "true", so that each website page knows this user is legit, and doesnt keep asking him for his password.

Sorry for the long rant, hope it helped...

[Hugo Ferreira][Positronic Dreams][Colibri 3D Engine][Entropy HL2 MOD]
[Yann L.][Enginuity] [Penny Arcade] [MSDN][VS RoadMap][Humus][BSPs][UGP][NeHe]
"I say we take off and nuke the entire site from orbit. It's the only way to be sure."

[edited by - pentium3id on February 26, 2004 10:54:57 AM]

MathewS

Feb 26, 2004 at 10:06 AM

why are your returning the setcookie value?
Try this.


function WriteCookie($User, $Pass) {
        $Array = array($User, $Pass);
        $CookieText = implode(":", $Array);
        setcookie("ToolmakerSoft", $CookieText, time()+36000);
}

Also remember that you will only be able to check whether the setcookie was set be reloading the page and use


echo $ToolmakerSoft;

[edited by - MathewS on February 26, 2004 11:09:58 AM]

Toolmaker

Feb 26, 2004 at 10:25 AM

I am returning the value to check what goes wrong, because it doesn''t work. I will try the extended time.

And I store username/password at this time just for testing, I will change it to sessions later. And why would password be as badly as storing a random string? In the end, faking a cookie is pretty damn easy.

Toolmaker

-Earth is 98% full. Please delete anybody you can.

SantaClaws

Feb 26, 2004 at 10:30 AM

Remember, if you're using IE6 to test this, IE6 won't allow cookies and such unless your site satisfys certain P3P requirements it sets for all sites. At the very minimum, you must create a compact policy for your site. It's a huge pain. If you just want to test the cookies and don't want to worry about this, you can go into Tool->Settings->Privacy and set the slider to the very bottom: "Accept All Cookies".

For more information on that check out this on W3 and this on MSDN.

You'll use the header() function in PHP to do this. For example, the compact policy for my site is: header('P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"' ); I wouldn't recommend directly using this for yours, as those codes represent what you will do w/ people's information and it might not match your site.

[edited by - SantaClaws on February 26, 2004 11:47:55 AM]

krez

Mar 3, 2004 at 3:24 PM

i am having the same problem. must i really read through all that crap on those websites just to use a cookie? i tried just putting in the header with the compact policy (generated from some web site i found), which didn''t work. i set my Internet Explorer 6 to the "Accept All cookies" setting and it still doesn''t work.

grumble grumble...

all i want to do is store a session ID in a cookie! argh!

Kylotan

Mar 3, 2004 at 5:05 PM

You need to write the cookie before you send anything. Don''t confuse HTML headers (which don''t really exist, unless you count the contents of the HEAD tag) with HTTP headers, which are where the cookie is sent. Setting up your cookie should be done before you send any text to the user at all, because sending any text will force PHP to write those HTTP headers before you get a chance to stash your cookie in there.

[ MSVC Fixes | STL Docs | SDL | Game AI | Sockets | C++ Faq Lite | Boost
Asking Questions | Organising code files | My stuff | Tiny XML | STLPort]

Puzzler183

Mar 3, 2004 at 5:12 PM

Uhm, also, try:

echo $_COOKIE[''variable''];

You may need to have the array index there if your server admin knows the basics of setting up PHP.

CGameProgrammer

Mar 3, 2004 at 6:18 PM

Is a colon ('':'') an acceptable cookie character? Semicolons are not, and of course equals signs are not, since those are special characters. Maybe you can try using a vertical bar (''|'') instead, or an ampersand (''&''). Also, do you realize you''re setting the cookie expiration time to 10 hours? That''s not very long.

Lastly, do this:


echo $_COOKIE[''ToolmakerSoft''];

to verify whether or not your cookie is being written.

~CGameProgrammer( );

_{-- Upload up to four 1600x1200 screenshots of your projects, registration optional. View all existing ones in the archives.}.

andrewo

Mar 3, 2004 at 7:38 PM

What''s your host? Some hosts require you to write the cookie in a specific way. I know that sites hosted by Lycos are required to set cookies in certain ways.

krez

Mar 3, 2004 at 9:14 PM

i''m running apache2 on my PC, just to play with it and PHP. i do set the cookie first:


<?PHP
setcookie(''test_cookie'', ''shit'');
?>
<HTML><HEAD><TITLE>TITLE</TITLE></HEAD>
<BODY>
<A HREF="./_cookies.php">FACK</A>
</BODY>

the "./cookies.php" file just tries to read and display the cookie (with a PHP "echo"), but i get nothing

as for the headers, i meant that i configured apache to insert the P3P header when a page is served, from instructions on the website where i got the compact policy. i also tried to do it with PHP (i.e. "header(blah blah etc)") both before and after setting the cookie.

i''m going to try again tomorrow when i am not so tired.

Toolmaker

Mar 4, 2004 at 3:22 AM

I rearranged my site into more clear resuable PHP code. thus, the problem is fixed now. I wasn''t doing it right I think

Toolmaker

-Earth is 98% full. Please delete anybody you can.

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.