In the following PHP code, I want to include a function, setting a cookie to stay logged in. The problem is, that samples I found on google aren't working. The users should get a cookie if they have signed in, without an additional "stay logged in" button. In every new request, the cookie should log in the user immediately.
<?php
// Initialize the session
session_start();
// Check if the user is already logged in, if yes then redirect him to welcome page
if(isset($_SESSION["loggedin"]) && $_SESSION["loggedin"] === true){
header("location: index.php");
exit;
}
// Include config file
require_once "configuser.php";
// Define variables and initialize with empty values
$username = $password = "";
$username_err = $password_err = "";
// Processing form data when form is submitted
if($_SERVER["REQUEST_METHOD"] == "POST"){
// Check if username is empty
if(empty(trim($_POST["username"]))){
$username_err = "Bitte Benutzernamen eingeben.";
} else{
$username = trim($_POST["username"]);
}
// Check if password is empty
if(empty(trim($_POST["password"]))){
$password_err = "Bitte Passwort eingeben.";
} else{
$password = trim($_POST["password"]);
}
// Validate credentials
if(empty($username_err) && empty($password_err)){
// Prepare a select statement
$sql = "SELECT id, username, password FROM users WHERE username = ?";
if($stmt = mysqli_prepare($link, $sql)){
// Bind variables to the prepared statement as parameters
mysqli_stmt_bind_param($stmt, "s", $param_username);
// Set parameters
$param_username = $username;
// Attempt to execute the prepared statement
if(mysqli_stmt_execute($stmt)){
// Store result
mysqli_stmt_store_result($stmt);
// Check if username exists, if yes then verify password
if(mysqli_stmt_num_rows($stmt) == 1){
// Bind result variables
mysqli_stmt_bind_result($stmt, $id, $username, $hashed_password);
if(mysqli_stmt_fetch($stmt)){
if(password_verify($password, $hashed_password)){
// Password is correct, so start a new session
session_start();
// Store data in session variables
$_SESSION["loggedin"] = true;
$_SESSION["id"] = $id;
$_SESSION["username"] = $username;
//Angemeldet bleiben:
// Redirect user to welcome page
header("location: index.php");
} else{
// Display an error message if password is not valid
$password_err = "Passwort falsch.";
}
}
} else{
// Display an error message if username doesn't exist
$username_err = "Benutzername oder Passwort falsch.";
}
} else{
echo "Störung.";
}
}
// Close statement
mysqli_stmt_close($stmt);
}
// Close connection
mysqli_close($link);
}
?>
<!DOCTYPE html>
Set the cookie after you verifying the password :
if(password_verify($password, $hashed_password)) {
// Password is correct, so start a new session
session_start();
// store user data in cookie
setcookie('user', json_encode([
'username' => $username,
'password' => $password
]), time() + 3600 * 24 * 30);
Then before checking loggedin
variable in the session, check for the cookie(please pay attention closely to the commented lines here):
// Check if there is an already logged in user in the cookie and then set its data to the session
if(isset($_COOKIE['user']) && !isset($_SESSION["loggedin"])) {
$user = json_decode($_COOKIE['user'], true);
// do the stuff to check if there is a user with $user['username'] and $user['password'] in the database, then if there is one, do as below :
$_SESSION["loggedin"] = true;
$_SESSION["id"] = $userId; // retrieved from database
$_SESSION["username"] = $user['username'];
// else if there is no user with that credentials from cookie, do the following to prevent further checking on database :
$_SESSION["loggedin"] = false;
}
// Check if the user is already logged in, if yes then redirect him to welcome page
if(isset($_SESSION["loggedin"]) && $_SESSION["loggedin"] === true){
In order to destroy the cookie when you're logging out the user, use unset
as already @DakshMehta said about this:
unset($_COOKIE['user']);
caution : It's not recommended to store user's password in the cookie due to security issues. So maybe you want to implement a token based authentication which refreshes the token after a short period of time or at least on each login. Using json web tokens(jwt) could be helpful on this topic and there is this package that implements jwt in php : firebase/php-jwt You should be aware that a token is acting exactly like a password, so when you store it in the cookie, you should consider some security tips which is mentioned here in the last section of this article : Where to Store your JWTs – Cookies vs HTML5 Web Storage
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.