Cookie newbie is confused

Report · Jul 06, 2009

I'm starting an application in CS4 which needs to know if a user is logged in. I've created a cookie at the top of my index page, with an initial value of 'not_logged_in'. Safari's web inspector shows this cookie exists and confirms its initial value and expiry.

Another page deals with logging in and then sets the cookie to a new value - 'is_logged_in'. Again, Safari web inspector confirms this has happened.

However, when I link back to the index page the cookie gets re-created with its default value again. I tried to deal with this by using the following code (at the very top of index.php):

<?php

$logged_in = strpos($_COOKIE['bt_login_state'], 'is_logged_in');

if ($logged_in === FALSE) {

$logged_in_Status = 'not_logged_in';

$domain = '.mydomain.com';

setcookie("bt_login_state", $logged_in_Status, time()+604800, '/',$domain,0);

}

?>

in the hope that the cookie would only be (re)created if it hadn't already been set. Naturally this doesn't work. The intent is that the cookie will eventually contain the i.d. of the logged in user as well but since I obviously don't understand what I'm doing that's all for later.

The page that's doing the logging in contains this code (inside a larger php script talking to a mysql database):

.

$logged_in_Status = 'is_logged_in';

setcookie("bt_login_state", $logged_in_Status);

.

What am I failing to understand here? I assume the cookie has to be created for the first time and then can be modified by pages throughout a site. But the page doing the creating should only do so if the cookie doesn't yet exist, no?

By the way my testing server is a Mac running OSX Server 10.4.11 or as Safari web inspector puts it:

Apache/1.3.41 (Darwin) DAV/1.0.3 mod_ssl/2.8.31 OpenSSL/0.9.7l PHP/4.4.9

thanks

Justin

Message was edited by: JustinHill-CKA because I mis-typed the php

Report · Jul 06, 2009

When I create a section of a site that requires user authentication (logging in) I never use cookies in my code at all.

session_start();

should be the first line (after the opening <?php) of every page that you want people to be able to use without being signed out.

There is a super global variable $_SESSION. You can put arrays of strings into it, but as far as I understand it you can't put other objects into it without serializing them first.

So you would want to use some sort of authentication variable similar to the status variable in your cookie.

You could call it $_SESSION['auth']. Before any of the private information of each page can be displayed you need to make sure that $_SESSION['auth'] is set to a variable of your choice. It is a good idea that the value is kept secret like a password.

There is a bit more about this. But going back to the beginning, you would definitely be able to use sessions to carry variables accross multiple pages, even the same page upon its revisit.

If you want more information on this I would really recommend PHP Solutions by David Powers. That is a great starting place for these sort of situations, and more.

Good luck!