PHP - MySql - Setting cookies not working

Question

<?php
$utype = $_POST['type'];
$username=$_POST['username'];
$pre = $_POST['pre'];
$fname = $_POST['fname'];
$fname = ucwords($fname);
$lname = $_POST['lname'];
$lname = ucwords($lname);
$address = $_POST['address'];
$city = $_POST['city'];
$city = ucwords($city);
$province=$_POST['province'];
$pcode = $_POST['pcode'];
$pcode = mb_strtoupper($pcode);
$area_code = $_POST['area_code'];
$number1= $_POST['number1'];
$number2= $_POST['number2'];
$phnum = "(".$area_code.")".$number1."-".$number2;
$email = $_POST['nemail'];
$opass=$_POST['pass1'];
$pass = md5($_POST['pass1']);
$time=date("F j, Y");
$status="Not Activated";
                                                   if($email=="" || $username=="" || $fname=="" || $lname=="" || $address=="" or $pass==""){                                                   die("<script language='JavaScript'>
                                                                    window.alert('Not Enough Data Provided!')</script>
                                                                    <meta http-equiv='REFRESH' content='0; r    egister.php'>");;
                                                            }
include 'db_connect.php';
$sql = "select * from estatedeal_login where username = '".strtolower($username)."' OR     email = '".strtolower($email)."'";

            $result=mysql_query($sql);
        $row=mysql_fetch_array($result);
            if($row){
                                                        die("<script language='JavaScript'>
                                                            window.alert('Username/E-mail address already Exists!')</script>
                                                            <meta http-equiv='REFRESH' content='0; register.php'>");;
            }


$sql="INSERT INTO estatedeal_login (username, email, password, utype, opass, time, status)
                VALUES ('$username', '$email', '$pass', '$utype', '$opass', '$time', '$status')";

$result=mysql_query($sql);
                if($result){
                        $sql2="Select uid from estatedeal_login where email='$email' AND password='$pass'";
                        $result2=mysql_query($sql2);
                        $row=mysql_fetch_array($result2);
                        $uid=$row["uid"];   



                        $sql3="INSERT INTO estate_userinfo(uid, pre, fname, lname, address, city, province, pcode, phnum, email) VALUES ('$uid', '$pre', '$fname', '$lname', '$address', '$city', '$province', '$pcode', '$phnum', '$email')";
                        $result3=mysql_query($sql3) or die("<script language='JavaScript'>
                                                            window.alert('Sorry, Database Error!')</script>
                                                            <meta http-equiv='REFRESH' content='0; register.php'>");;
                        if ($result3){

                                        $hour = time() + 3600*2; 
                                        setcookie('USERNAME_COOKIE', $email, $hour);
                                        setcookie('PASSWORD_COOKIE', $pass, $hour);
                                        if($utype=="Realtor"){ die("<meta http-equiv='REFRESH' content='0; regRealtor.php'>");; }
                                    echo "<script language='JavaScript'>
                                    window.location ='main.php';</script>";
                                    }
    }
    else{
        die(mysql_error());
    }
?>

Above is my code. It inserts the datafields correctly in mysql but does not setting the cookies on the client side. If I try login using the information i have inserted in the database, The same code for setting up cookies works fine on the login page. Is there any more options to set the cookies.?

    $hour = time() + 3600*2; 
 setcookie('USERNAME_COOKIE', $email, $hour);
 setcookie('PASSWORD_COOKIE', $pass, $hour);

Your script is vulnerable to SQL injections. – Gumbo Sep 15 '13 at 07:46 — Gumbo, Sep 15 '13 at 07:46

score 0 · Answer 1 · answered Sep 15 '13 at 07:37

I stronly recommend you to learn about $_SESSION and how to clean variables that you read from $_POST or $_GET before inserting anything in the database;

http://php.net/manual/en/function.mysql-real-escape-string.php Also take into account the warnings that you see on the page that I sent you.

score 0 · Accepted Answer · edited May 23 '17 at 11:50

Not a direct answer to your question, but possibly useful:

In stead of cookies, you could use SESSION, take a look at this question: Cookie VS Session.

You might also like to take a look at UserCake which implements user management using SESSION. The following is a snipet from UserCake (login.php):

      //Passwords match! we're good to go'

      //Construct a new logged in user object
      //Transfer some db data to the session object
      $loggedInUser = new loggedInUser();
      $loggedInUser->email = $userdetails["email"];
      $loggedInUser->user_id = $userdetails["id"];
      $loggedInUser->hash_pw = $userdetails["password"];
      $loggedInUser->title = $userdetails["title"];
      $loggedInUser->displayname = $userdetails["display_name"];
      $loggedInUser->username = $userdetails["user_name"];

      //Update last sign in
      $loggedInUser->updateLastSignIn();
      $_SESSION["userCakeUser"] = $loggedInUser;

To me at least, this feels so much cleaner then calling setcookie('USERNAME_COOKIE', $email, $hour);.

score 0 · Answer 3 · answered Sep 15 '13 at 07:44

0

1 Try putting ob_start()

<?php
ob_start()

2 try putting path argument

setcookie('USERNAME_COOKIE', $email, $hour,'/');
setcookie('PASSWORD_COOKIE', $pass, $hour,'/');

answered Sep 15 '13 at 07:44

albertdiones

735
5
10

score 0 · Answer 4 · answered Sep 15 '13 at 07:48

Use session instead of cookie. Sessions are more secured than cookies & stored on servers.

Use session_start(); at the start of PHP file & then store anything inside session like this

$_SESSION['email'] = $email;

& take values stored in session by session_start() function at start of file

$email = $_SESSION['email'];

Sessions are more secured as they are stored on server not browser.

PHP - MySql - Setting cookies not working

4 Answers4

1 Try putting ob_start()

2 try putting path argument