Limeni Posted December 25, 2009 Share Posted December 25, 2009 Hi there, Merry Christmas Im new here and new to PHP, I hope you can help me with some questions. Im writing my web app, and i have login screen where user enters his username and passoword, then I check im MySQL database is it ok, and if its ok and user exists, I send him to protected pages, i have 3 protected pages that only registred users can acess. Now the problem is I dont know should I use Sessions or Cookies to check if user is loged in? Cookies are cool and simple but I dont know how to encrypt them so anyone can see them. What is the best method to encrypt cookie? And with Sessions I joust cant destroy session with session_destroy(); Here is the code of secure pages, and logout.php Secure page (there are 3 of them but they are all the same as this one): <?php session_start(); $username = $_SESSION['username']; $password = $_SESSION['password']; include 'database_connect.php'; $sql = "SELECT * FROM users WHERE username='$username' AND password='$password'"; $sql = mysql_query($sql) or die(mysql_error()); $count = mysql_num_rows($sql); if ($count !== 1) { header("location: login-fail.php"); } ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>PHP generated</title> </head> <body> <?php echo $username . " <p>welcome to Content Manager</p>" ?> <a href="admin-site-manager.php">Site Manager</a> <a href="admin-account-manager.php">Account Manager</a> <br/> <a href="logout.php">Logout</a> </body> </html> And this is logout.php <?php session_start(); session_destroy(); header("location: index.php"); ?> So my questions are: 1. Whats wrong with this script, it works great, but logout is not working, when i click logout, it sends me to index.php, but if I enter URL of "secured" page it show me that page and tells me Im loged in :/. So i gues my logout.php is not working. I guess that after 24 minutes it wouldnt show me secure page anymore but i didnt wait that long. In documentation it writes that it takes 24 minutes for session to compleatly destroy, if we dont change php.ini file. 2. To secure pages so only registred users can acess them, like I did now, what is better, Sessions, or Cookies, or is there any way to combain them? Is it ok to use only sessions like I did? Is it secure, and what would could I get if I use cookies too. Can someone explain me when should I use Sessions and when Cookies? 3. About Cookies encryption, what is the best way to encrypt a cookie, so if Im sending $password from one page to another and store that password in a cookie, how to secure it from users to see it? What is the best way to do that? So thats it I hope you will help me guys Quote Link to comment https://forums.phpfreaks.com/topic/186305-secure-pages-sessions-vs-cookies-session_destroy-help/ Share on other sites More sharing options...
Limeni Posted December 25, 2009 Author Share Posted December 25, 2009 I tryed this too for logout.php <?php // Initialize the session. // If you are using session_name("something"), don't forget it now! session_start(); // Unset all of the session variables. $_SESSION = array(); // If it's desired to kill the session, also delete the session cookie. // Note: This will destroy the session, and not just the session data! if (ini_get("session.use_cookies")) { $params = session_get_cookie_params(); setcookie(session_name(), '', time() - 42000, $params["path"], $params["domain"], $params["secure"], $params["httponly"] ); } // Finally, destroy the session. session_destroy(); header("location: index.php"); ?> Its now working This too sends me to index.php, but when I enter URL of "secured" pages it opens them like Im loged in. How can I destroy session compleatly? Quote Link to comment https://forums.phpfreaks.com/topic/186305-secure-pages-sessions-vs-cookies-session_destroy-help/#findComment-983883 Share on other sites More sharing options...
laffin Posted December 25, 2009 Share Posted December 25, 2009 1) I wouldnt use sessions to store redundant information, consider them as a temporary variables instead, for quick lookups in the db or other information. I would do something like this in login if(isset($_SESSION['loggedin']) && isset($_SESSION['id']) && $_SESSION['loggedin']) { die("Already logged in"); } // Login form processing here // $_SESSION['loggedin']=true; $_SESSION['id']=$row['id']; // This would be from your database on logout I wud just set $_SESSION['loggedin'] to false any secure pages, just check those two variables, and load the user record from the $_SESSION['id'] Quote Link to comment https://forums.phpfreaks.com/topic/186305-secure-pages-sessions-vs-cookies-session_destroy-help/#findComment-983921 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.