Cookie destroyed on session destroy, Why?

Question

i want to store cookie for remember me concept at the time of login. its working fine but when i logout cookie also destroy. my code are as follows...

Login page:

 <?php
if(isset($_POST['submitLogin']))
    {
        extract($_POST);
        $obj = new validation();
        $obj->add_fields($uname, 'req',ER_EMAIL );
        $obj->add_fields($passwd, 'req', ER_PSW);
        $error = $obj->validate();
        $password=md5($passwd);

           $qry1=$con->recordselect("SELECT *,concat(first_name,' ',last_name) as user_name FROM user WHERE uname='".addContent($uname)."' AND password='".addContent($password)."'");
             $tot_rec=mysql_num_rows($qry1);
             $valid_user=mysql_fetch_array($qry1);

             if($tot_rec>0)
             {                      
                if($valid_user['status']=='a')
                   {                         
                     if($valid_user['password_status'] == 0)
                     {
                          $_SESSION["userId"]=$valid_user['id'];
                          $_SESSION["user_name"]=$valid_user['user_name'];

                           if($error=='')
                            {
                                 if (isset($_POST['rememberme'])) {

                                setcookie('uname',$_POST['uname'],time() + (24 * 60 * 60 * 30));
                                setcookie('passwd',$_POST['passwd'],time() + (24 * 60 * 60 * 30));
                                setcookie('rememberme',1,time() + (24 * 60 * 60 *30 ));

                                }
                                else
                                {
                                    setcookie('uname',$_POST['uname'],time() - (24 * 60 * 60 * 30));
                                    setcookie('passwd',$_POST['passwd'],time() - (24 * 60 * 60 * 30));
                                    setcookie('rememberme',1,time() - (24 * 60 * 60 * 30));
                                }

                            }
                          redirectPage(home.php");

                     }


                   }
                else
                {
                        $error=ER_DACT;
                        redirectPage("login.php?Err=ER_DACT");

                }
             }
             else{
             $error=ER_INVUP;
             redirectPage("login.php?Err=ER_INVUP");
             }

         }

?>

here is my logout page:

<?php

    $_SESSION["userId"]="";
    $_SESSION["name"]="";
    session_destroy();
    redirectPage(login.php);

?>

Update

HTML code here:

<form action="login.php" method="post" name="frmCP1" id="frmCP1">
                <div class="space10"></div><!--space10-->


                <div class="text18blue">Student Login</div>
                <div class="h-line"></div>

                <div><strong>Username:</strong> <span class="errortext">*</span></div>
                <div>
                    <input name="uname" id="uname" type="text"   value="<?php if(isset($_COOKIE['uname'])&&$_COOKIE['uname']!=''){echo $_COOKIE['uname'];}else {echo '';} ?>"  />   
                </div>
                <div class="space10"></div>
                <div><strong>Password:</strong> <span class="errortext">*</span></div>
                <div><input  id="passwd"  name="passwd" type="password" value="<?php if(isset($_COOKIE['passwd'])&&$_COOKIE['passwd']!=""){echo $_COOKIE['passwd'];}else {echo "";} ?>" /></div>
                <div class="space10"></div>
                <div class="checkbox fl"><input <?php if(isset($_COOKIE['rememberme']) && $_COOKIE['rememberme']=="1"){echo "checked='checked'";} ?>  id="remember" name="rememberme"  type="checkbox" value="1"/></div>
                <div>Remember me</div>
                <div class="space10"></div>
                <div><input id="submitLogin" name="submitLogin" type="submit" value="Login" /></div>
                <div class="space10"></div>
                <div><a href="javascript:void(0)" id="dialog_link">Forgot password?</a></div>
                <div class="flclear"></div>

        </form>

so when i logout my cookie also destroy why? thanks in advance

Just saying but instead of having 24 * 60 * 60 * 30 cant you just say 2592000? Also it is using deprecated mysql_ functions. I'd suggest switching over to PDO or mysqli. — Lemon Drop, Apr 13 '13 at 05:48
@lemondrop yes i can use but i just want to find this problem — Yadav Chetan, Apr 13 '13 at 05:51
How do you check the cookie information on the login page for the auto-login feature? Also, you are storing a plain-text password as a cookie, never, ever, ever, do that. @lemondrop saying `24*60*60*30` is segregating the time so it is easy to modify without recalculating it, and also makes it easier for another programmer to read the amount of time that it is conveying with ease. — Jon, Apr 13 '13 at 05:58
@deceze according to my knowledge session_destroy() destroy session only but why cookie also destroyed. — Yadav Chetan, Apr 13 '13 at 06:12
@YadavChetan Do you still see the cookies in your browser? Are you able to see the cookies in your browser after log in? — Jon, Apr 13 '13 at 06:19
@Jon , no i cant see its destroy at the time of logout only i checked all other pages when i login but after logout i cant see cookie . — Yadav Chetan, Apr 13 '13 at 06:22
Are you seriously storing a plaintext password in a cookie!? That's just evil. — Bart, Apr 13 '13 at 09:28
Don't include ANY version of the password at all in the cookie. You're exposing sensitive data. Look here for a better more secure approach http://stackoverflow.com/questions/244882/what-is-the-best-way-to-implement-remember-me-for-a-website. Never ever trust a client. — Bart, Apr 13 '13 at 09:41

mukund · Accepted Answer · 2013-04-13T06:48:56.993

2

That should not be the case. Destroying session only should destroy session not cookie

Try adding path info for better performance

setcookie('uname',$_POST['uname'],time() - (24 * 60 * 60 * 30), '/');
setcookie('passwd',$_POST['passwd'],time() - (24 * 60 * 60 * 30), '/');
setcookie('rememberme',1,time() - (24 * 60 * 60 * 30), '/');

That will definitely remove your problem

edited Apr 13 '13 at 06:48

answered Apr 13 '13 at 06:33

mukund

2,253
1
18
31

Cookie destroyed on session destroy, Why?

1 Answers1