473,395 Members | 1,468 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,395 software developers and data experts.

Are These Persistent Cookie Ideas Safe And Interesting ?

Php Masters!

Every php persistent cookie tutorial I come across always save the user's password onto the user's hdd. To make things worst. Save it on the hdd without encrypting it.
Now, I thought it would be best if the cookie got named under the user's computer mach address and the mach address got saved in the db.
Then, when the user loads the login page, the cookie can check it's cookie name against the db and if there is a match then auto log the user into his/her account.
But, now I read, it is not possible to acquire the user's mach address unless uservon same lan of my webserver.

Q1a. So, what else can act as a substitute for the mach address ? What else can php grab from the user's computer which it can use as a reference against the Username to identify that it is the same user ?
IPs change. No good using that.

Q1b. How-about the user's computer name ? Can it grab that from the user's computer so it can use that as the mach substitute or use that as the cookie name ?

Q1c. Or maybe I just get the script to name the cookie in this format:

username-ip

And make that cookie available as long as the user has not got his/her ip changed.
That way, when the user loads the login page whilst the ip hasn't changed, the cookie can check it's cookie name (username-ip) against the db and if there is a match then auto log the user into his/her account. What do you think ?
Can you guys show me how to do this by editing my code ?
I have been googling all night and reading whatever I find on the subject. But, I am still stuck and need to see some code samples to clear the confusion.

<?php
session_start();
if(!empty($_POST["login"])) {
$conn = mysqli_connect("localhost", "root", "", "blog_samples");
$sql = "Select * from members where member_name = '" .
$_POST["member_name"] . "' and member_password = '" .
md5($_POST["member_password"]) . "'";
$result = mysqli_query($conn,$sql);
$user = mysqli_fetch_array($result);
if($user) {
$_SESSION["member_id"] = $user["member_id"];

if(!empty($_POST["remember"])) {
setcookie ("member_login",$_POST["member_name"],time()+ (10
* 365 * 24 * 60 * 60));
setcookie
("member_password",$_POST["member_password"],time()+ (10 * 365 * 24 * 60 * 60));
} else {
if(isset($_COOKIE["member_login"])) {
setcookie ("member_login","");
}
if(isset($_COOKIE["member_password"])) {
setcookie ("member_password","");
}
}
} else {
$message = "Invalid Login";
}
}
?>
<style>
#frmLogin {
padding: 20px 60px;
background: #B6E0FF;
color: #555;
display: inline-block;
border-radius: 4px;
}
.field-group {
margin-top:15px;
}
.input-field {
padding: 8px;
width: 200px;
border: #A3C3E7 1px solid;
border-radius: 4px;
}
.form-submit-button {
background: #65C370;
border: 0;
padding: 8px 20px;
border-radius: 4px;
color: #FFF;
text-transform: uppercase;
}
.member-dashboard {
padding: 40px;
background: #D2EDD5;
color: #555;
border-radius: 4px;
display: inline-block;
}
.member-dashboard a {
color: #09F;
text-decoration:none;
}
.error-message {
text-align:center;
color:#FF0000;
}
</style>

<?php if(empty($_SESSION["member_id"])) { ?>
<form action="" method="post" id="frmLogin">
<div class="error-message"><?php if(isset($message)) { echo $message; } ?>
</div>
<div class="field-group">
<div><label for="login">Username</label></div>
<div><input name="member_name" type="text" value="<?php
if(isset($_COOKIE["member_login"])) { echo $_COOKIE["member_login"]; } ?>"
class="input-field">
</div>
<div class="field-group">
<div><label for="password">Password</label></div>
<div><input name="member_password" type="password" value="<?php
if(isset($_COOKIE["member_password"])) { echo $_COOKIE["member_password"]; }
?>" class="input-field">
</div>
<div class="field-group">
<div><input type="checkbox" name="remember" id="remember" <?php
if(isset($_COOKIE["member_login"])) { ?> checked <?php } ?> />
<label for="remember-me">Remember me</label>
</div>
<div class="field-group">
<div><input type="submit" name="login" value="Login" class="form-
submit-button"></span></div>
</div>
</form>
<?php } else { ?>
<div class="member-dashboard">You have Successfully logged in!. <a
href="logout.php">Logout</a></div>
<?php } ?>

Q1d. What do you think about this unique idea ? Let me know if the idea is flawed or not.
During registration, the system would ask the user to upload any img.
During persistent cookie checking (meaning, when the user has loaded the login.php or home.php), the user would be shown a list of imgs to select. If he/she selects the right one they uploaded during registration then the system (cookie) would auto log them in.
Alternatively, the user can be shown a question and a few answer options in a checkbox or dynamic drop down ui that list the correct answer aswell as the incorrect answers. If the user selects the correct answer from the answering options then the user is auto logged in. Clicking the mouse is simpler than typing the username & password. And so, this little id check won't bother the user that much. Would it bother you, as a user ?

Alternatively, the user can be shown a list of imgs where an img can be of his/her family member (eg, brother, uncle) and a question that asks "what is this person top you ?" and show a few answer options in a checkbox such as:
1. Brother;
2. Uncle;
3. Friend;

etc. If the user selects the right answer then he/she is auto logged in. Else not.
If you like any of the ideas mentioned in Q1d, then how-about editing my code and showing us newbies a sample code on how to achieve the one you liked ?

Thanks!
Oct 12 '17 #1
0 1875

Sign in to post your reply or Sign up for a free account.

Similar topics

0
by: obhayes | last post by:
Hi All, Im using classic ASP (3.0) and I have a web farm with 2 webservers (webserver A and webserver B, both windows server 2003). I do not want to store any client specific information on the...
1
by: brad | last post by:
Hi, Im using classic ASP (3.0) and I have a web farm with 2 webservers (webserver A and webserver B, both windows server 2003). I do not want to store any client specific information on the...
1
by: Marco Rispoli | last post by:
I am using this function to write a cookie: private static void SaveCookie(string CookieName, string CookieValue, bool Persistent) { HttpContext.Current.Response.Cookies.Value = CookieValue;...
0
by: Kepler | last post by:
I'm testing very basic FormsAuthentication and having trouble with non-persistent cookies. Once authenticated with a non-persistent cookie, if I leave the browser alone for 30 minutes,...
4
by: craigkenisston | last post by:
I have an asp.net application in which I sometimes store a persistent cookie once the user has logged in and this has been working great. However, I now add some user information like, username,...
8
by: bashful.belle | last post by:
I'm using Forms authentication and a non persistent cookie in my asp.net application. How do i get the cookie to time out after a period of inactivity, say 10 minutes, and force the user to login...
0
by: robert | last post by:
I have noticed in .net 2 that when authenticating a user, setting the cookie using either redirectfromloginpage or setauthcookie, specifying true for the persistent parameter that the cookie is...
4
by: GaryDean | last post by:
I'm using the 2.0 login control with the "remember me" setting. When checked the cookie only last for a few hours then it is asking again for a login. I don't see any time settings. I know back...
8
by: WiW | last post by:
FYI: It appears that Phorm (a targeted advertising system which taps into ISP networks) will be setting its own persistent cookie for most every website the user visits. It appears as though the...
3
by: rh.krish | last post by:
I have a typical ASP.NET 2.0 Forms authentication application which authenticates against Active Directory. I use non-persistent cookie so that the user is NOT remembered across browser sessions....
0
by: ryjfgjl | last post by:
If we have dozens or hundreds of excel to import into the database, if we use the excel import function provided by database editors such as navicat, it will be extremely tedious and time-consuming...
0
by: ryjfgjl | last post by:
In our work, we often receive Excel tables with data in the same format. If we want to analyze these data, it can be difficult to analyze them because the data is spread across multiple Excel files...
0
by: emmanuelkatto | last post by:
Hi All, I am Emmanuel katto from Uganda. I want to ask what challenges you've faced while migrating a website to cloud. Please let me know. Thanks! Emmanuel
1
by: Sonnysonu | last post by:
This is the data of csv file 1 2 3 1 2 3 1 2 3 1 2 3 2 3 2 3 3 the lengths should be different i have to store the data by column-wise with in the specific length. suppose the i have to...
0
by: Hystou | last post by:
There are some requirements for setting up RAID: 1. The motherboard and BIOS support RAID configuration. 2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...
0
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers,...
0
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven...
0
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows...
0
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.