Authenticating users with MySQL & cookies

[rrreview]

Basic question here.

I have a MySQL database full of usernames, passwords, and ID's. To log in, they use a form that checks data in the database, and if it matches, it sets 2 cookies - clanid set to their ID, and clanname set to their name. Theoretically, to check to see if they're logged in or not, all I would need to do is either have an !isset($cookie) code at the top of every restricted page.

Anyways, here's my question...if you delete a user, but they still have the cookie on their computer, how would I keep that user from being able to access the restricted areas? I'm thinking maybe add a "restricted" setting to the table, and when the user accesses the site, it checks the database with their user id to see if restricted=1 or something, and deletes their cookie, then deletes their info from the database.

I'd appreciate any help.

[frezno]

If in the cookie a session id is included you only have to check whether the session id in the cookie equals the current session id; session cookies

[Gaheris]

How about changing your "is-logged-in" part, instead of just looking for a cookie you could try to log in with the data in the cookies (userid & hashed password).

[rrreview]

If in the cookie a session id is included you only have to check whether the session id in the cookie equals the current session id; session cookies

Wouldn't that defeat the whole purpose of having cookies in the first place? If this were the case, wouldn't it be better if I switched over to sessions instead of cookies?

[boccio]

why don't you set your cookie to expire after 24 or 48 hrs?

stay good

[frezno]

Wouldn't that defeat the whole purpose of having cookies in the first place? If this were the case, wouldn't it be better if I switched over to sessions instead of cookies?

Cookies are not unsafe as such, since they were on your machine and not at the server or whereever else.

Of course, sessions are always the better choice.
You shouldn't rely just on cookies. You can set expiration time of cookie to the past thus they were deleted immediately after use.