isset and if function in php with or operator

Question

I have some PHP code to check user login status which check if session variables are set or cookies are set. If either of condition is true then it grand permission otherwise redirect to login page. Code looks like this :

if(isset($_SESSION["userid"]) || isset($_COOKIE["userid"]) && isset($_SESSION["username"]) || isset($_COOKIE["username"])  && isset($_SESSION["password"]) || isset($_COOKIE["password"])){
} else {
header("location : register.php");
}

The problem is that if session get destroyed (by closing browser or any other reason) it redirect the user to login page. But what it has to do is read cookies data and grant user access as cookies are still present (I've checked that cookies are still present by echo cookie data).

Answer 1

&& has a higher precedence than || , so you need to guard the || with brackets. Also, having an empty if statement is just redundant:

if(!(isset($_SESSION["userid"]) || isset($_COOKIE["userid"]) ||   
   !(isset($_SESSION["username"]) || isset($_COOKIE["username"])) || 
   !(isset($_SESSION["password"]) || isset($_COOKIE["password"]))) {
    header("location : register.php");
}

Answer 2

You need to add a couple of breakers to group your statements like this:

    if( 
    ( isset($_SESSION["userid"]) || isset($_SESSION["username"]) && isset($_SESSION["password"]) ) 
||
    ( isset($_COOKIE["userid"]) || isset($_COOKIE["username"]) && isset($_COOKIE["password"]) )
){
    // Your action
} else {
header("location : register.php");
}

Such statement will check if there is set COOKIE or SESSION and check or user_id or user name AND password. If you need AND user_id AND username than replace || in brackets between isset() functions for this fields.

Answer 3

You need to change your condition a bit because you are confusing it within SESSION and Cookie . Put them together with && and separate them with || like below:-

if((isset($_SESSION["userid"]) &&  isset($_SESSION["username"]) && isset($_SESSION["password"])) || (isset($_COOKIE["userid"]) && isset($_COOKIE["username"])  && isset($_COOKIE["password"]))){

    // your action that you want

} else {

   header("location : register.php");
}

Note:- Take care that same things are going to applied everywhere (on each other pages and conditions), otherwise you will face problem.

Also more dependency on cookie is not good, because it can be changed by the user any time.

Answer 4

I think your if condition is missing some parenthesis. To make your code more readable you could create two functions

function isSessionValid()
{
    return isset($_SESSION["userid"]) && isset($_SESSION["username"]) && isset($_SESSION["password"]);
}

function isCookieValid()
{
    return isset($_COOKIE["userid"]) && isset($_COOKIE["username"]) && isset($_COOKIE["password"]);
}

and then use these functions in your if statement :

if (isSessionValid() || isCookieValid()) {

} else {

}