Sessions to Cookies and vice versa

[B_CooperA]

I'm finishing up a project client ordered me but now he wants the optional "Keep me logged in" checkbox in the login page. The problem is that I've saved almost every data that is needed inside of $_SESSION variables

but if the user has ticked that "Keep me logged in" - checkbox, it should retrieve all the data inside of $_COOKIE variables. So I'm getting a lot "undefined index" - errors when I've logged using that that "Keep Me Logged In" - checkbox.

 

So, how should I implement this without coding hundreds of line by checking conditions whether user has ticked the checkbox or not?

 

Thanks in advance.

[trq]

Just use the value stored in a cookie to identify the user. You would then auto login the user behind the scenes using the same code that you already using.

[kicken]

Your remember me checkbox should just set a cookie with a random token in it, nothing else. Then you add some code to your script which will check if that cookie exists and if so, verify the token against the database. If the token is valid then you pre-load the necessary $_SESSION variables from the database.

[B_CooperA]

Your remember me checkbox should just set a cookie with a random token in it, nothing else. Then you add some code to your script which will check if that cookie exists and if so, verify the token against the database. If the token is valid then you pre-load the necessary $_SESSION variables from the database.

 

In lightness? Is there any good tutorials/articles you can link to me so I get a bit more understanding how this will work?

[B_CooperA]

Here's what I've created so far:

<?php

	error_reporting(E_ALL ^ E_NOTICE);

class Login {

	private $error;
	private $connect;
	private $email;
	private $password;
	public $row;

public function __construct(PDO $connect) {

	$this->connect  = $connect;
	$this->error 	= array();
	$this->row 		= $row;


}

public function doLogin() {

	$this->email = htmlspecialchars($_POST['email']);
	$this->password = htmlspecialchars($_POST['password']);
	$this->rememberme = $_POST['rememberme'];

	if($this->validateData()) {

		$this->fetchInfo();

	}

	return count($this->error) ? 0 : 1;

}

public function validateData() {

	if(empty($this->email) || empty($this->password)) {

		$this->error[] = "Täyttämättömiä kenttiä";

	} else {

	return count($this->error) ? 0 : 1;

}

}

public function fetchInfo() {

	$query = "SELECT * FROM users WHERE email = :email AND  activation_token IS NULL";
	$stmt = $this->connect->prepare($query);
	$stmt->execute(array(

				':email' => $this->email,

		)); 



	if($stmt->rowCount() == 0) {
		$this->error[] = "Väärä käyttäjätunnus tai salasana";
		return 0;

	} else {

			$row = $stmt->fetch(PDO::FETCH_ASSOC);

				$_SESSION['user_id'] = $row['user_id'];
				$_SESSION['email'] = $row['email'];
				$_SESSION['name'] = $row['name'];
				$_SESSION['profilepic'] = $row['profilepic'];
			

			if(isset($this->rememberme)) {
				setcookie("loggedin", "yes", time() + 25200);
	
			}

	}

	if (Register::cryptPass($this->password) != $row['password']) {
	$this->error[] = "Virheelliset kirjautumistiedot";

	} else {

		return true;

	}
		return count($this->error) ? 0 : 1;

	}



public function displayErrors() {

	if(!count($this->error)) return;
		echo "<div class='login_error'>";
		foreach($this->error as $key=>$value) {
		echo "<p>".$value."</p>";

	}

echo "</div>";

}


public function doLogout() {

	session_destroy();

}

}
?>

And I'm checking it in every other files like so:

if (isset($_SESSION['email']) || isset($_COOKIE['loggedin'])) {
?>			
	<div id="header_container_isloggedin">
	
	<div class="container_12">
	<header id="header">
	<div class="grid-12">

	<ul id="menu">

	<li class="profile-name">

        <a href="profile.php?id=<?php echo $_SESSION['user_id']; ?>">
        <span class="header_username">

	<img src="images/thumbnails/<?php echo $_SESSION['profilepic']; ?>" 
        class="profile_evensmaller"/>

	<span class="header_name"><?php echo $_SESSION['name']; ?></span></span></a>

	</li>

</ul>

Yes, it will redirect me back to the protected page since the cookie is set and not destroyed, but it doesn't show my profile pic or name after I close my browser and trying to go back because they are stored inside session variables (?)