I can't figure out why I can't remove a cookie or it's value:
I have simple log in script, when user enters correct login details, this is
setcookie('logged', $admin['username'], time()+60*60*24*365);
Also, session_start() is present on all pages.
When I want to log off a user, the following happens:
if($page=='logoff') {
setcookie('logged', "", time() - 3600);
unset($_COOKIE['logged']); // tried also this
session_destroy();
$_SESSION=null;
header("Location: index.php"); // if this is removed, the code below acts like there's no $_COOKIE['logged'] or it's empty (until refresh)
}
Once it gets redirected to index.php the $_COOKIE['logged'] is back with the old value, like something would set it again (nothing does for sure, I even removed the one and only login cookie set line)
I couldn't find a solution in similar questions. Tested in chrome and IE.
You can't "unset" a cookie. "Expire" it by setting it to a value in the past:
<?php
// set the expiration date to one hour ago
setcookie("logged", "", time() - 3600);
?>
http://www.w3schools.com/php/php_cookies.asp
Related
I have created a logout.php page to let the user sign out from the website and redirects them to the sign in page.
however what ever i do, the cookies are not getting deleted, so when the user gets redirected to the singin page the latter examines the cookies and then find it, therefore logs the user in.
Below is the code of logout.php:
<?php
unset($login);
if (isset($_COOKIE['xxx'])){
setcookie('xxx', false, time() - 3600,"/");
}
if (isset($_COOKIE['yyy'])){
setcookie('yyy', false, time() - 3600,"/");
}
header("Location: singin.php");
die();
?>
Please note that this php page is in subfolder protected by password and the html link redirects to a php file that require() the logout.php file.
use php unset() to delete your cookie as, you can get the complete details here delete the cookie
if (isset($_COOKIE['xxx'])){
unset($_COOKIE['xxx']);
}
if (isset($_COOKIE['yyy'])){
unset($_COOKIE['yyy']);
}
or, set value as null and a negative time for your cookie as
setcookie('xxx', null, -1, '/');
setcookie('yyy', null, -1, '/');
or, set value as empty and a past time for your cookie as
setcookie("xxx", "", time()-3600);
setcookie("yyy", "", time()-3600);
I have found finally the reason behind the issue.
it's because I have put session_cache_limiter('public'); in my code, so which I presume prevents the client to set the cookie to an expiry date.
I have done that because I don't want the client to ask the user each time they hit back to resubmit the form.
It seems that it's not the correct practice, I'll post another question for that.
Thanks all for the help.
I am new to php, but I have 2 years experience in asp.net. When I am calling logout.php It doesn't doesn't removed the cookie values.
<?php
if (isset($_COOKIE['C_username'])) {
unset($_COOKIE["C_username"]);
unset($_COOKIE["C_password"]);
setcookie("C_username", '', time() - 3600);
setcookie("C_password", '', time() - 3600);
}
echo "<script>alert('".$_COOKIE["C_username"]."');</script>" ; //Here the cookie value is found.
header( 'Location: ../index.php');
?>
After redirecting to another index.php, there also the cookie found.
The cookie is not cleared until the page is reloaded by the browser so if you change your javascript to actually look for the cookie on the browser rather than use the PHP (on server) version of it you may get more predictable results.
Also remember that cookies and header() statements must be run before any other data is sent to the browser so your code should be generating an error anyway as your header() statement is after an echo statement.
So try
<?php
if (isset($_COOKIE['C_username'])) {
setcookie("C_username", '', time() - 3600);
setcookie("C_password", '', time() - 3600);
header( 'Location: ../index.php');
exit;
}
echo '<script>alert(document.cookie);</script>";
?>
Additional Point:
Dont put passwords in cookies There is no need to do this anyway as if you are using it to log the user on when they re-visit, you dont need the password you just set the fact that thay are logged in because you see a cookie, it does not need to have a valid userid/password in that/those cookies.
Also remember that cookies can be turned off by the browser!
I'm trying to make my login sessions last longer, so that people don't get logged out of my website too early. For example, making a blog post and losing it when they submit because php expired their cookie.
Ideally I'd like to give them say a 2 hour session where they won't be logged out, which will refresh every time they load the page (this code snippet below is before the header of each secure page)
This is what I am trying, but it comes up with an error for the setcookie() saying that there was a division by zero? What am I doing wrong here?
//How long sessions last
$hours = 2;
// php.ini setting required for session timeout.
ini_set('session.gc_maxlifetime',$hours*60*60);
ini_set('session.gc_probability',1);
ini_set('session.gc_divisor',1);
//Set the session parameters and start session
$sessionCookieExpireTime=$hours*60*60;
session_set_cookie_params($sessionCookieExpireTime);
session_start();
// Reset the expiration time upon page load
if (isset($_COOKIE[session_name()]))
{
setcookie(session_name(), $_COOKIE[session_name()], time() + $sessionCookieExpireTime, "/");
}
EDIT: Now working as the problem was non-standard quotes and apostrophes. Just in case anyone copies this code and uses it. Code above works now thanks!
If you would like you could add this for when your cookie expires:
time()+60*60*24*30
This is like saying that the cookie expires in 60secs, 60mins, 24h and so on. You should also check out a tutorial on cookies here: http://www.w3schools.com/php/php_cookies.asp
So I have this code on my index.php:
<?php if(isset($_POST['cookie'])) { setcookie("RememberMe", "Yes", time()+1209600); } ?>
If the user has checked the remember me box then it will set a cookie with the name RememberMe for 2 weeks. This part works fine.
Now the issue I'm having is deleting this cookie when they press logout.
On pressing logout, they get redirected to logout.php which has the following code:
<?php include_once('config.php');
include_once('functions.php');
unset($_COOKIE['RememberMe']);
setcookie("RememberMe", "", time()-3600);
$_SESSION = array(); session_destroy();
?>
<meta http-equiv="refresh" content="0;../index.php">
but for some strange reason that won't delete the cookie? Any ideas as to why?
You may want to check if the path the cookie is set at is correct. By default PHP sets the cookie path to the directory it's set in and it will not be available (nor possible to delete) from different locations.
Few more tips:
there is no need to unset $_COOKIE and $_SESSION
instead of redirecting using a meta tag redirect with HTTP headers:
header('Location: /index.php'); // or whatever is the path you want to redirect to
Not the cleanest but
Check the time zone is correct
Ensure you are nuking the correct cookie( case sensitive )
Failing all of they over writing the cookie will nuke it anyway
So...
Setcookie('mycookie') // nukes the cookie with a blank entry
Cookie cancelations can sometimes require the same time value as they were set.
setcookie("RememberMe", "", time()-1209600);
remove this line
unset($_COOKIE['RememberMe']);
What I'm wanting to do is for the remember me checkbox. I have it set up to where if there is a cookie set for the username then it checks the checkbox. What I'm wanting to do is if there was a cookie but the user decides to uncheck it just in case someone else wants to access their account from the same computer then it'll delete the cookie I"m not sure how to accomplish this. Here's what I have so far.
if (isset($_POST['remember'])) {
// Sets an expiration time for the cookie
$my_expiration = time()+60*60*24*100;
// Sets the cookie for the username
setcookie("username", $username, $my_exiration, "/");
} else {
setcookie ("username", "", time() - 3600);
}
This will work if you add the path ("/") to the second setcookie() call. Since you are omitting that, the browser is treating the cookie as a different one than the previously-set cookie, and will therefore not delete it:
setcookie ("username", "", time() - 3600, "/");
(At least I assume that's what's going wrong. You didn't actually ask a question, you just sort of threw code up there and said "I'm doing this" without indicating if anything isn't working as you expect.)
Set it to null
setcookie("username", null, 0, "/");
Both setting and deleting must have path
setcookie("ST",$_COOKIE['ST'],time()+1000,'/'); //for creation
setcookie('ST',NULL,-1,'/'); //for deletion
I played with this until get it done.
Hope it useful.