Why is cookie never set after login validation?

[Franco Cassar]

Ok, so far I have always used JSP and Servlets for my web programming, but now I needed to make use of PHP... and I'm stuck at something really basic: setcookie.

The form works fine, and it checks with the database for the username/pass ok (because when I supply good credentials I return back to the homepage, and with bad credentials it appends the error parameter with the URL).

Anyway, the cookie is never set. The browser never receives a cookie. This is my login.php.

<?php
$host="*********"; // Host name
$username="****"; // Mysql username
$password="***"; // Mysql password
$db_name="************"; // Database name
$tbl_name="users"; // Table name
 
// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("ERROR: Cannot connect to MySQL Server on 'localhost'.<br/><br/><i>Remember this is only a prototype demo!<br/>Franco</i>");
mysql_select_db("$db_name")or die("cannot select DB");
 
// username and password sent from form
$myusername=$_POST['uname'];
$mypassword=$_POST['pass'];
 
// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
 
$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);
 
// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
 
// If result matched $myusername and $mypassword, table row must be 1 row
if($count==1){
//Create cookie
    $hour = time()+3600;
    setcookie('ID_group_planner', $_POST['myusername'], $hour);
    setcookie('Key_group_planner', $_POST['mypassword'], $hour);
    header("location:index.php");
}
else {
header("location:index.php?login_error=1");
}
?>

Thanks a lot! Really appreciate your help at this.

[guillermobytes]

are you sure there are no spaces at the beginning of your script, or anything that would be sent before the header(location...) is called?

cookies are sent along with headers, so make sure they are set before headers are sent. And make sure headers are not sent before you think they are... :)

let me know

[Markus]

See this note.

[Franco Cassar]

Well that is the whole script. There is absolutely nothing else in the login.php file. Unless I understood you incorrectly that is.

[Franco Cassar]

@Markus: Thanks! Let me try :)

[Franco Cassar]

No. Still doesn't create it...

Modified code is like this:

if($count==1){
//Create cookie
    $hour = time()+3600;
    header("location:index.php");
    setcookie('ID_group_planner', $_POST['myusername'], $hour);
    setcookie('Key_group_planner', $_POST['mypassword'], $hour);
}
else {
header("location:index.php?login_error=1");
}
 

[Franco Cassar]

Okay solved it. Problem lied in

$_POST['myusername']
 

myusername isn't the name of a POST parameter but of fixed version of the username.

Thanks for the help though :)

[guillermobytes]

I'm not sure, but i think you should better use your sanitized $myusername variable rather than the $_POST['anything'];
I don't know how that could be exploited but, i mean, if you already sanitized your variable, better use it...

[Franco Cassar]

Yep. In fact I fixed it to use $myusername instead of the original variable.

Thanks again guys! :)

[Markus]

You wouldn't have needed to post this question had you turned on error reporting ;)