Secure pages Sessions vs. Cookies & session_destroy() help


Posted on 16th Feb 2014 07:03 pm by admin

Im new here and new to PHP, I hope you can help me with some questions.

Im writing my web app, and i have login screen where user enters his username and passoword, then I check im MySQL database is it ok, and if its ok and user exists, I send him to protected pages, i have 3 protected pages that only registred users can acess.

Now the problem is I dont know should I use Sessions or Cookies to check if user is loged in? Cookies are cool and simple but I dont know how to encrypt them so anyone can see them. What is the best method to encrypt cookie?

And with Sessions I joust cant destroy session with session_destroy();

Here is the code of secure pages, and logout.php

Secure page (there are 3 of them but they are all the same as this one):
Code: <?php
session_start();

$username = $_SESSION['username'];
$password = $_SESSION['password'];

include 'database_connect.php';

$sql = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$sql = mysql_query($sql) or die(mysql_error());
$count = mysql_num_rows($sql);

if ($count !== 1) { header("location: login-fail.php"); }

?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>PHP generated</title>
</head>

<body>

<?php echo $username . " <p>welcome to Content Manager</p>" ?>
<a href="admin-site-manager.php">Site Manager</a>
<a href="admin-account-manager.php">Account Manager</a>
<br/>
<a href="logout.php">Logout</a>

</body>

</html>
And this is logout.php

Code: <?php
session_start();
session_destroy();
header("location: index.php");
?>
So my questions are:

1. Whats wrong with this script, it works great, but logout is not working, when i click logout, it sends me to index.php, but if I enter URL of "secured" page it show me that page and tells me Im loged in :/. So i gues my logout.php is not working. I guess that after 24 minutes it wouldnt show me secure page anymore but i didnt wait that long. In documentation it writes that it takes 24 minutes for session to compleatly destroy, if we dont change php.ini file.

2. To secure pages so only registred users can acess them, like I did now, what is better, Sessions, or Cookies, or is there any way to combain them? Is it ok to use only sessions like I did? Is it secure, and what would could I get if I use cookies too. Can someone explain me when should I use Sessions and when Cookies?

3. About Cookies encryption, what is the best way to encrypt a cookie, so if Im sending $password from one page to another and store that password in a cookie, how to secure it from users to see it? What is the best way to do that?

No comments posted yet

Your Answer:

Login to answer
344 Like 49 Dislike
Previous forums Next forums
Other forums

please help me in this update statment
hi every one

if I have table and this data in it

id name
10

records between 2 dates
Hello all,

I have a date tracked table which contains effective_start_date and effective

getting a website's source code as a variable? How?
Hey guys, is there any way for me to get the source code of a website as a variable for me to work w

php and downloading
I want to use a php script to create two files. Then I want it to redirect (or whatever) to have tho

Problems generating word documents on server side for security reasons
I have a problem with word documentation generation when generating a word document (docx) with PHP.

Combining refCursors and Summing
Given the following DDL:

CREATE TABLE FOODSALESTEST ("WEEKNBR" NUMBER, "ST

How can i steam a video on my PHP site? (non YouTube)
Basically I have a PHP site and don't want to give page rank to YouTube. I just want to stream a bas

Allegro crashes when running load_bitmap. Why?
I can not get Allegro to load any BMP images. Here is a section of test code. The picture is in the

fire away
i launched about 4 months ago as a lagit co. i have 2 paying clients, 1probono, 1 side progect, and

Is it possible to stop reservation creation in PM Order?
Hi All,

Is it possible to stop reservation creation in PM Order?

Thanks in adv

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash