note 86762 deleted from function.md5 by tularis
| From: | tularis@php.net | Date: | Thu, 14 Jul 2011 22:49:30 +0000 |
| Subject: | note 86762 deleted from function.md5 by tularis | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-181524@lists.php.net to get a copy of this message | ||
Note Submitter: sandaimespaceman at gmail dot com
----
I usually MD5 the username, password and IP to set login cookie. MD5ing IP will make cookie thief on
other computers fail.
<?php
//... connect to database, load list of users, etc...
$username = $_POST['username'];
$password = $_POST['password'];
/*
$cookie may look like this:
variables
$username = "username"
$password = "password"
_SERVER['REMOTE_ADDR'] = 42.52.56.24
before md5:
"usernamepassword42.52.56.24"
after md5:
"a3470ce826283eca7ce3360d0f26b230"
*/
$cookie = md5 (
$username .
$password .
$_SERVER['REMOTE_ADDR']
);
setcookie ("login", $cookie);
//when the log in cookie is SET...
if (isset($_COOKIE['login']) )
{
foreach ($user_list as $user => $pass)
{
//match the user list with the cookie
if (
md5 (
$user .
$password .
$_SERVER['REMOTE_ADDR']
)
== $_COOKIE['login']
)
{
header("Location: index.php");
die("logged in");
}
}
//when login is wrong
header("Location: login.php");
die("wrong username/password");
}
?>