Set a cookie to save login details PHP

Question

I have a typical login (username, password) and also want to include a 'save my details' check box. The login form Posts its values to login_script.php and if the login is successful, the user is redirected to the main page of the site.

I'm tying to use this method to save the login details

//Remember Me Function

if(isset($_POST['remember_me'])){

    // Set a cookie that expires in 24 hours
    setcookie("username",$username, time()+3600*24);
    setcookie("password",$password, time()+3600*24);

}

Now from what I understand, setcookie("username",$username, time()+3600*24); must be set at the top of the PHP page before any other code is executed.

My issue is that I do not want to set the cookie unless the user has successfully logged in. However due to the set cookie function being called in the middle of the script after the login test, it will not work.

Any ideas? Cheers.

Answer 1

First of all: do not save passwords in a cookie! This is a very bad idea security-wise.

As for your problem: there is no way around it, you need to have no output at all before setting your cookie. There are two ways to achieve this:

Solution 1: the login page always redirects

Have your login requests go to a script which sets a cookie (if the login was successful) and then always redirects the user to another page (e.g. a welcome screen, or back to the login page if unsuccessful). The login script will not emit any output, therefore you can set cookies before redirecting.

Solution 2: output buffering

Start output buffering at the beginning of your script. After the check for successful login, set the cookie first and then stop output buffering with something like ob_end_flush.

Personally I consider solution #1 to be more elegant and superior in function.

Answer 2

It's a very bad practice to store password in somewhere users have access (on the client side). Worse still, you did not hash or encrypt the password when storing the password (clients can see the password!)

A good security policy is not never allow anyone to see the actual password. Except when the code is working with it.

You can do this instead:

• Store the password in the session
• Extend the session expiry to a longer time

Or you can instead

• hash and encrypt the password
• store the login information to a file on the server
• give the file a unique name
• store the name to a cookie
• each time you receive the cookie with the correct file name, look up the file and retrieve the login information.

But I always recommend the former because it's easier to implement and the session handling is done by PHP (unless you're overriding the session handling)