When I click on ‘remember me’ and after sign out, when I try again to login cookies a

[itsmenarwal]

I have a login form in which i have a username, password and a remember me radio button option. Now I want it so that when I've signed out from home page and I try again to login then without asking for a username and password I get logged in because I am going to store the username and password values into cookie.

I wrote code on password_match. php page(action page of login page)

$con=mysql_connect("localhost","root","");
if(!$con)
{
die('Could Not Connect:'.mysql_error());
} 

mysql_select_db("tcs",$con);

if(isset($_COOKIE['cookname']) && isset($_COOKIE['cookpass']))
{
$usr = $_COOKIE['cookname'];
$pwd = $_COOKIE['cookpass'];
$pwd=hash('sha1',$_POST['password']);
}

else
{
$usr=$_POST["username"];                 
$pwd=hash('sha1',$_POST['password']);           
}
</code>
Through this code I am checking is there any cookie with cookname and cookpassword which contain username and password. If no cookie is found with this name then retrieve username and password from textboxes directly, if the user enters them.

Now the code which I am going to write will set a cookie if username and password exists:
<code>
if ($result) { $row=mysql_fetch_array($result);

if (($row["Username"]==$usr) && ($row["Password"]==$pwd))
{
    if(isset($_POST['remember']))
    {
    setcookie("cookname", $row['Username'], time()+60*60*24*100, "/");
    setcookie("cookpass", $row['Password'], time()+60*60*24*100, "/");
    }


$_SESSION['employee']['id']=$row['User Id'];
    $_SESSION['employee']['username']=$row['Username'];

    header ("Location: home_page.php");

}

Now when starting, when I enter username and password and if these are right show a cookie must have been set and if now I am signed out and try the same sign in form, as according to me it should retrive cookie but nothing happining here. I am not able to implement it. Where am I going wrong?

[shabinesh]

'Remember me' and 'Stay logged in' are two different things. when you log off the session is killed. Now, if you want to get automatically logged in you may have to store the session_id as well in the cookie and process it later in the program for this purpose.

[kovik]

@shabinesh: No and no. When you manually log off, the session is no longer authenticated as the user, but it is by no means destroyed. Even guest users have sessions. Also, you wouldn't just save the session ID in a cookie and reuse it. Firstly, sessions expire when they are inactive for a certain period of time. Secondly, this allows a user that finds this cookie to save that value in their own cookie and always access this account.

Anyway, refer to my response in another thread for how to accomplish this:

http://bytes.com/topic/php/answers/880488-how-secure-pages-php-using-session#post3541792

[itsmenarwal]

But in this thread solution is not given in this thread it is told that u should add an extra column in ur database to store login status.I dont know what should be stored there and how i can retrive this state at login page..Can i use all password matching php coading on login page also...plz explain little bit more for those guies who need some more explaiantion in form of code to grab concept...

[kovik]

The answer's given. I won't go more in-depth than that. I have given you the theory. The implementation is up to you.