PHP - Sessions And Cookies - Logged In Until Users Sign Out.

I am trying to build my own custom login script.

What I am trying to achieve is once a user has logged in depending on wether they have checked the keep me logged in checkbox they have two options. If they haven't checked it then it creates session variables only, and if they have checked it it also creates cookie variable as well as the session variables.

If they then close their browser / tab without logging out and then revisit the site they will get redirected to login page because the active session variable is no longer there. As soon as they land on the loggin page, it automatically checks for the cookie variable and if it exists, it uses it to login and redirect them automatically.

However the problem that I am facing is that the session variable is still being trashed after a default amount of idle time and forcing a login.

My goal is that the user shouldn't have to re-login unless they have either clicked the logout button.

Can someone please have a look through my solution and advise me as to wether this is the correct method that I am implementing, if there is an easier way to achieve what I want, and is this a secure way to handle user logins.

Thanks in advance.

Andrew



Here is the check code I have placed at the top of each admin page.

Code: [Select]
<?php 
session_start();
$url = (!empty($_SERVER['HTTPS'])) ? "https://".$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'] : "http://".$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
$uid = $_SESSION['uid'];
if (!isset($uid)) {
header('location:login.php?redirect='.$url);
exit();
}
?>
Next we have the code for the login.php file.

Code: [Select]
<?php include ('functions.php'); ?>
<?php get_header('login'); ?>
    <div id="login-result">
    <?php
connect();
$redirect = htmlspecialchars(mysql_real_escape_string(addslashes($_GET['redirect'])));

if(isset($_COOKIE['remembered'])){

$username = htmlspecialchars(mysql_real_escape_string(addslashes($_COOKIE['remembered']['username'])));
$password = htmlspecialchars(mysql_real_escape_string(addslashes($_COOKIE['remembered']['password'])));

$sql      = "SELECT * FROM usersT WHERE username='$username' AND password='$password'";
$result   = mysql_query($sql);
$count    = mysql_num_rows($result);
$row      = mysql_fetch_array($result);

$uid      = $row['uid'];
$fname    = $row['firstname'];
$lname    = $row['lastname'];
$role     = $row['role'];

   
if($count==1){
$sql2    = "UPDATE usersT SET status = '1' WHERE uid = '$uid'";
$result2 = mysql_query($sql2);

if($result2){

session_register("uid");
session_register("uname");
session_register("ulevel");
$_SESSION["uid"]    = $uid;
$_SESSION["uname"]  = $fname;
$_SESSION["ufullname"]  = $fname . " " .$lname;
$_SESSION["urole"] = $role;
                                        $home = get_option('home');

if(!empty($redirect)) {
header( 'Location: '. $redirect ) ;
exit(); 
}
else {
header( $home ) ;
exit();
}

}

}
else {
echo "<div class=\"error rounded5 shadow\">Invalid username or password!</div>";
}
}
else if (isset($_POST['admin_login'])){

if(isset($_POST["username"]) && isset($_POST["password"])){

$username_p = htmlspecialchars(mysql_real_escape_string(addslashes($_POST["username"])));
$password_p = htmlspecialchars(mysql_real_escape_string(addslashes($_POST["password"])));
$psw        = md5($password_p);

$sql3      = "SELECT * FROM usersT WHERE username='$username_p' AND password='$psw'";
$result3   = mysql_query($sql3);
$count3    = mysql_num_rows($result3);
$row3      = mysql_fetch_array($result3);

$uid      = $row3['uid'];
$fname    = $row3['firstname'];
$lname    = $row3['lastname'];
$role     = $row3['role'];

   
if($count3==1){
$sql4    = "UPDATE usersT SET status = '1' WHERE uid = '$uid'";
$result4 = mysql_query($sql4);

if($result4){

session_register("uid");
session_register("uname");
session_register("ulevel");
$_SESSION["uid"]    = $uid;
$_SESSION["uname"]  = $fname;
$_SESSION["ufullname"]  = $fname . " " .$lname;
$_SESSION["urole"] = $role;
$home = get_option('home');

if(isset($_POST['remember'])) { 
setcookie("remembered[username]", $username, time() + 86400 * 365 * 2);
setcookie("remembered[password]", $psw, time() + 86400 * 365 * 2); 
}

if(!empty($redirect)) {
header( 'Location: '. $redirect ) ;
exit(); 
}
else {
header( $home ) ;
exit();
}

}

}
else {
echo "<div class=\"error rounded5 shadow\">Invalid username or password!</div>";
}
}
}
?>
    </div><!-- / login-results -->
    <div id="login" class="rounded5 shadow">
<form name="loginform" id="loginform" action="<?php $_SERVER['PHP_SELF']; ?>" method="post">
            <p>
                <label for="username">Username<br>
                <input type="text" name="username" id="username" class="rounded5" value="<?php echo $username_p; ?>" size="20" tabindex="10" /></label>
            </p>
            <p>
                <label for="password">Password<br>
                <input type="password" name="password" id="password" class="rounded5" value="<?php echo $password_p; ?>" size="20" tabindex="20" /></label>
            </p>
            <p class="submit">
            Keep me logged in<input type="checkbox" name="remember" id="remember" /><br /><br /><a href="" class="left">Lost your password?</a>
                <input type="submit" name="admin_login" id="admin_login" class="btn rounded10 right" value="Log In" tabindex="100" />
            </p>
            <div class="cleaner"></div><!-- / cleaner -->
        </form>
    </div><!-- / login-->
<?php get_footer('login'); ?>

Finally here is the code I am using for the logout.php page.

Code: [Select]
<?php
session_start();
include ('functions.php');
connect();
$uid    = mysql_real_escape_string($_SESSION['uid']);
$sql    = "UPDATE usersT SET status = '0' WHERE uid = '$uid'";
$result = mysql_query($sql);

if($result) {
session_unset(); 
session_destroy();

if(isset($_COOKIE['remembered'])){ 
setcookie("remembered[username]", $username, time() - 3600);
setcookie("remembered[password]", $psw, time() - 3600); 
header("location: login.php");
}
exit();
}
else {
echo "You couldn't be logged out at this time.";
}
?>