PHP Cookies重定向到错误的角色

Question

good day... i have some problem here and hopefully someone can help

if(isset($_COOKIE['role'])== "admin")
{ echo $_COOKIE['username']; 
header("location: admin/adminUI.php");
}
elseif(isset($_COOKIE['role']) == "customer")
{ echo $_COOKIE['username']; 
header("location: customer/customerUI.php");
}

the cookies right in PHP i set this earlier

setcookie ("username", $username, time()+3600,"/");
setcookie ("role", $role, time()+3600,"/");

but either i choose the role = admin or customer, the header will also redirect to admin page... may i know what is the problem?

thanks

Answer 1

If output anything before the header() directive, like you're doing with echo, the redirect won't work at all. You need to remove the echo so that redirect you're specifying in the header works.

Also, isset() only checks if a variable is set , not if it equals another string . Therefore, this check:

if(isset($_COOKIE['role'])== "admin")

is wrong, and should be changed to something like:

if(isset($_COOKIE['role']) && $_COOKIE['role'] == "admin")

Finally, as mentioned, you should never ever ever base checking of priviledges depending on the value of a cookie, as these can be changed by the users using simple client side tools. Use sessions instead.

Check the PHP session handling page for more info:

http://www.php.net/manual/en/book.session.php

Here's a relatively straightforward example of how to authenticate users in PHP, using sessions and a MySQL database:

http://www.phpeasystep.com/phptu/6.html

Answer 2

First, trusting a cookie -- which is easily edited by a user -- is like hanging the key to your apartment on you front door in plain sight. It's kinda worse than having no security at all.

That said, you shouldn't echo before header() (at least not without output buffering). Read the notes in the header() documentation . Also, echoing anything before redirect is meaningless.

Last, but not least, the isset() issue, as Filippos beat me to it.

Answer 3

It is not advisable to use COOKIE is such cases. A more better approach would be to use SESSION variables. Also there is not point of using echo as you are redirecting in the very next statement. Last but not the least, you cannot use '==' with isset function.

Go through this Isset Function

Answer 4

This right code:

if(isset($_COOKIE['role'])&&$_COOKIE['role']== "admin")
{ 
  header("location: admin/adminUI.php");
}
elseif(isset($_COOKIE['role'])&&$_COOKIE['role'] == "customer")
{ 
  header("location: customer/customerUI.php");
}