cookie set but system not read

[runrunforest]

Hi,

I am working on user cookie and session, I set cookie after user login so they don't have login again within 45 minutes.

Upon testing, I close the browse then open it again, go to user section, i have to login again, which not what i wanted.

[Raju Gautam]

Can you please show how you have done so far for setting the cookie? Is it server where you have stored the session or in the user's browser? And how you have done retrieving the registered/set cookie in second time?

[runrunforest]

My login.php

if(isset($_SESSION['loggedin']))
{
	$url=URL;
 
	setcookie(active[username], $username, time()+3600,"/",$url);
	setcookie(active[email], $email, time()+3600,"/",$url);
	setcookie(active[password], $password, time()+3600,"/",$url);
 
	if(isset($_POST['ref']))
	{
		header('Location:' . base64_decode($_POST['ref']));
		exit();
	}
	else
	{
		header('Location:'.$url.'account.php');
		exit();
	}
 
}

my user section

if(isset($_COOKIE['active']))
{	
	$username = $_COOKIE['active']['username'];
 
	$result = mysql_query("SELECT id, username, email, name, land_line, mobile, address, city, region, feedback FROM user WHERE username= ('{$username}') ") or die(mysql_error());
 
	if(mysql_num_rows($result) == 1)
	{
		$rows = mysql_fetch_array($result);
	}
}
else
{
$url=URL;
 
header('Location:'.$url.'login.php');
 
exit();
 
}

[Raju Gautam]

Are you sure these lines are not giving any warnings/errors?

setcookie(active[email], $email, time()+3600,"/",$url);
setcookie(active[password], $password, time()+3600,"/",$url); 

I think the keys are to be quoted:

setcookie("active[email]", $email, time()+3600,"/",$url);
setcookie("active[password]", $password, time()+3600,"/",$url); 

[crmalibu]

The first step is to make sure the cookies are being sent to the client. Some browsers have addons which can view http headers, which is the best way. You can also just check your cookies and see if it's there, although this only tells you if the browser accepted it. Same goes for typing the following into your browsers address bar

javascript:alert(document.cookie)

Make sure the browser is not set to delete cookies upon being closed, and disable antivirus software. There's some kinda IE related bug I beleive where cookies may not get set if the http response includes a location header, which you're doing. I've never encountered it but thought id mention it.

[runrunforest]

Are you sure these lines are not giving any warnings/errors?

setcookie(active[email], $email, time()+3600,"/",$url);
setcookie(active[password], $password, time()+3600,"/",$url); 

I think the keys are to be quoted:

setcookie("active[email]", $email, time()+3600,"/",$url);
setcookie("active[password]", $password, time()+3600,"/",$url); 

error fixed but problem still remains.

I am giving you the source code hope you can help me sort it out

login.php

<?php
$errors = array();
 
if(isset($_POST['submit']))
{
	$fields = array('email', 'password');
 
	foreach($fields as $field)
	{
		if(!empty($_POST[$field]))
		{
			${$field} = mysql_real_escape_string(trim($_POST[$field]));
		}
		else
		{
			$errors[] = 'you forget '.$field;
		}
 
	}	
	if (isset($email, $password)) 
	{
		$salt = 'hello';
 
		$result = mysql_query("SELECT id, username, activation FROM user WHERE (email = '{$email}' AND password = SHA1('{$password}{$salt}'))")or die(mysql_error());
 
		if (mysql_num_rows($result) > 0) 
		{
			$activation = mysql_result($result, 0, 'activation');
 
 
			if(strlen($activation) < 1)
			{
				$errors[] = 'account not yet activated';
			}
			else if($activation == 1)
			{ // now logged in, creating cookie	
 
				$username = mysql_result($result, 0, 'username');
 
				$url=URL;
 
				setcookie("active[username]", $username, time()+3600,"/");
				setcookie("active[email]", $email, time()+3600,"/");
				setcookie("active[password]", $password, time()+3600,"/");
 
				if(isset($_POST['ref']))
				{
					header('Location:' . base64_decode($_POST['ref']));
					exit();
				}
    			else
    			{
					header('Location:'.$url.'account.php');
					exit();
				}
 
			}
 
		}
		else
		{			
			$errors[]= 'Email or password incorrect';
		}
 
	}
 
}
 
?>

account_section.php

<?php
 
if(isset($_COOKIE['active']))
{	
	$username = $_COOKIE['active']['username'];
 
	$result = mysql_query("SELECT id, username, email, name, land_line, mobile, address, city, region, feedback FROM user WHERE username= ('{$username}') ") or die(mysql_error());
 
	if(mysql_num_rows($result) == 1)
	{
		$rows = mysql_fetch_array($result);
	}
}
else
{
$url=URL;
 
header('Location:'.$url.'login.php');
 
exit();
 
}
 
?>

my website, you can see how it works from here;
http://translate.google.com/translat...-8&sl=vi&tl=en

email: mymail@gmail.com
password: hellobaby

[runrunforest]

The first step is to make sure the cookies are being sent to the client. Some browsers have addons which can view http headers, .

I've checked the cookies, they are stored in browser

[felgall]

Then you need to look at the part of the code that is supposed to read the cookie and log you back in as it must be that part that isn't working.

[runrunforest]

Then you need to look at the part of the code that is supposed to read the cookie and log you back in as it must be that part that isn't working.

I guess so.

I have been looking at the code for a long time still can not find out what have been done improperly.

[felgall]

Have you tried echoing $_COOKIE['active'] to see what it contains?

[Raju Gautam]

Have you tried echoing $_COOKIE['active'] to see what it contains?

Since $_COOKIE['active'] is the array itself so try to

print_r($_COOKIE['active']); 

rather than echoing.

[runrunforest]

I've checked and the value is as expected, which is good.

But the weird behavior still remains

[Raju Gautam]

If you have the values while print_ring the $_COOKIE['active'], try to echoing your SQL to see how it looks with the retrieved value:

$sql = "SELECT id, username, email, name, land_line, mobile, address, city, region, feedback FROM user WHERE username='" . $username . "'";
echo $sql;
$result = mysql_query($sql) or die(mysql_error()); 

Can you post here the output of print_r($_COOKIE['active'])?

[runrunforest]

If you have the values while print_ring the $_COOKIE['active'], try to echoing your SQL to see how it looks with the retrieved value:

Can you post here the output of print_r($_COOKIE['active'])?

Ok, here is the result
Array ( [username] => no hot [email] => mymail@gmail.com [password] => hellobaby ) .

http://www.badede.com/login.php try to log in with the id above, then close the browser then open back, open http://www.badede.com/login.php again, it will force you to log in, but dont log in yet, click on the account link (tai khoan) , it will let you go through as if you logged in.

Now you see the problem I was talking about

[felgall]

So the problem is with the processing of what was read from the cookie. Having read the cookie you need to redirect to the same page hat logging in goes to once the login is successful.