PHP - Cookie And Session

hey guys im using a session cookie to store a user_id, only if user has clicked to remember me on the login form...that way when autenticating it checks id in db and if matching a user it logs in automatically.   now the problem i want to just remove user_id from a session cookie.  if i use the code below to delete the user_id session then it will remove all session cookies.    is there a way just to remove 1 session cookie?  thank you

// create session cookie
session_start();
session_set_cookie_params('3600', 'C:\Users\Ricky\Desktop\www\BiSi\private\tmp\session', 'http://127.0.0.1/', true, true);
ini_set('session.gc_probability', 1);
session['user_id'] = 1;

//delete session cookies
setcookie (session_name(), null, time() - 3600);
session_regenerate_id(true);

any help/advise would be greatful...cheers guys  

Hi to everyone, I'm new to the forum and I'm posting here because I ended up in a logical problem for my next script development. I need to get some data of external websites (with vbulletin board), perfectly legal. Using file_get_contents i can print the page content on my server and then use jquery's powerful selectors to get my data.   The problem is that these data are shown only to logged in users so i would need this script (maybe using cURL?) to either login to the external website and then persists the connection or maybe if the user who is executing my script is already logged in that website then use his login? (most likely impossible I think..)   This is my code so far (found on some sites and merged into this)

$data = array('vb_login_username' => 'Scanu', 'vb_login_password' => 'grgfgrgrfbtgbt');
$ch = curl_init(); 
curl_setopt($ch,    CURLOPT_URL,            "http://www.vbulletin.org/forum/login.php?do=login"); 
curl_setopt($ch,    CURLOPT_AUTOREFERER,         true); 
curl_setopt($ch,    CURLOPT_COOKIESESSION,         true); 
curl_setopt($ch,    CURLOPT_FAILONERROR,         false); 
curl_setopt($ch,    CURLOPT_FOLLOWLOCATION,        false); 
curl_setopt($ch,    CURLOPT_FRESH_CONNECT,         true); 
curl_setopt($ch,    CURLOPT_HEADER,             true); 
curl_setopt($ch,    CURLOPT_POST,                 true); 
curl_setopt($ch,    CURLOPT_RETURNTRANSFER,        true); 
curl_setopt($ch,    CURLOPT_CONNECTTIMEOUT,     30); 
curl_setopt($ch,    CURLOPT_POSTFIELDS,         $data); 
$result = curl_exec($ch); 
curl_close($ch);


$pattern = "#Set-Cookie: (.*?; path=.*?;.*?)\n#"; 
preg_match_all($pattern, $result, $matches); 
array_shift($matches); 
$cookie = implode("\n", $matches[0]); 


$ch = curl_init(); 
curl_setopt($ch,    CURLOPT_URL,            "http://www.vbulletin.org/forum/"); 
curl_setopt($ch,    CURLOPT_COOKIE,                $cookie); 
curl_setopt($ch,    CURLOPT_AUTOREFERER,         true); 
curl_setopt($ch,    CURLOPT_COOKIESESSION,         true); 
curl_setopt($ch,    CURLOPT_FAILONERROR,         false); 
curl_setopt($ch,    CURLOPT_FOLLOWLOCATION,        false); 
curl_setopt($ch,    CURLOPT_FRESH_CONNECT,         true); 
curl_setopt($ch,    CURLOPT_HEADER,             false); 
curl_setopt($ch,    CURLOPT_POST,                 false); 
curl_setopt($ch,    CURLOPT_RETURNTRANSFER,        true); 
curl_setopt($ch,    CURLOPT_CONNECTTIMEOUT,     30); 
$result = curl_exec($ch); 
curl_close($ch);
echo $result;
?>

It just shows the same page for unregistered users. Any help or advice is appreciated, i'm very new to this type of script..

Hi, I am just recently getting this error message:Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at /home/XXX/chordsandguitar.com/index.php:46) in /home/jchords/chordsandguitar.com/index.php on line 48

this is no doubt related to the fact that my site has been hacked along with 1000's of others that are on dreamhost. I don't know if it's related to php file permissions some of my files may have had had their permission set for read-write when they should not have been. They have all been changed to the more restrictive 755 or 644.

So here is how I am using the session_start to store some variables:

Code: [Select]

session_start();

if (!isset($_SESSION["count"]))
{
$_SESSION["count"]=0;
}
else
$_SESSION["count"]++;

if ($_SESSION["count"] == 0)
{
$scale_menu = 'C';
$variation_menu = 'maj';
$code_id = '1';
}
else
{
//allows retreiving the value of the drop-downs after the Select button has been pushed
// has to be skipped on the first access or overwrites starting vars. to null
if (isset($_GET['s_menu']))
$scale_menu = $_GET['s_menu'];
else
$scale_menu = $_GET['scale_menu'];
}


So any ideas why I am getting this error?

Thanks,

Jacques

I am confused why I am getting the following error and was wondering if I could get a 2nd pair of eyes..
error:
[29-Jul-2010 20:58:01] PHP Warning:  session_start() [<a href='function.session-start'>function.session-start</a>]: Cannot send session cookie - headers already sent in /home/curren11/public_html/mysite***.com/file_monitor.php on line 2
[29-Jul-2010 20:58:01] PHP Warning:  session_start() [<a href='function.session-start'>function.session-start</a>]: Cannot send session cache limiter - headers already sent (output started at /home/curren11/public_html/mysite***.com/file_monitor.php:2) in /home/curren11/public_html/mysite***.com/file_monitor.php on line 2

Here is the code:
<?php
session_start();

$root_path = realpath(getcwd());
$error_monitor_file = $root_path.'/file_modify.txt';
$hour = date("H");
$today = date("m-d-Y");



     $myFile2 = "file_monitor.php.log";
     $fh3 = fopen($myFile2, 'a');
     $log_msg = "Last ran on: ".$today." at: ".$hour." \n";
     fwrite($fh3, $log_msg);
    

function scan_dir($path)
{
 $out = array();
 $files = opendir($path);

while ($f = readdir($files))
{
  $extension = substr($f,-3);
     
   if ($f=='.' or $f=='..' or $extension=='jpg' or $extension=='JPG' or $extension=='png' or $extension=='gif' or $f=='file_monitor.php' or $f=='file_modify.txt' or $f=='file_monitor.php.log' or $f =='error_log'  ) 
     {
   continue;
 }
 
  if (is_dir($path.'/'.$f))
    {
  $out = array_merge($out, scan_dir($path.'/'.$f));
} 
  //if  (((!is_dir($path.'/'.$f)) && ($f!='.' or $f!='..' or $extension!='jpg' or $extension!='JPG' or $extension!='png' or $extension!='gif'))
  else
  //  {
    $out[] = $path. '/'. $f;
//}
}

  $_SESSION['all_files'] = $out;
  
 return $out;
}

$a = scan_dir(getcwd());

$count_array = count($_SESSION['all_files']);
$loop_count=0;
while($loop_count < $count_array)
{
  // file in directory when was it last changed ?
  $filechange1 = date("m-d-Y-H", filemtime($_SESSION['all_files'][$loop_count]));
 
 // was it chnaged today and have I sent out an alert yet?
 if($filechange1 == $today."-".$hour) 
  {
$fh2 = fopen($error_monitor_file, 'a');
fwrite($fh2, "\n alert, file: ".$_SESSION['all_files'][$loop_count]." was changed today within the last hour ! \n");
    fclose($fh2);
  }
 $loop_count ++;
 // log file? was it changed this past hour?
 if (file_exists($error_monitor_file))
 {
   $filechange_log = date("m-d-Y-H", filemtime($error_monitor_file));
 
if ( ($loop_count == $count_array ) && ($filechange_log == $today."-".$hour ) )
{
        email();
     }
}
}

// function for email...
function email()
{
require_once ('class.phpmailer.php');

$mail = new PHPMailer();

$mail->IsSMTP();                                   // send via SMTP
$mail->Host     = "localhost"; // SMTP servers
$mail->SMTPAuth = true;     // turn on SMTP authentication
$mail->Username = "**c66@***ar.com";  // SMTP username
$mail->Password = "*****"; // SMTP password
$mail->From     = "***@***.com";
$mail->FromName = "Colonial Cottage File Changed";
$mail->AddAddress("email@*****.com"); 

$mail->WordWrap = 50;                              // set word wrap
//$mail->AddAttachment("/var/tmp/file.tar.gz");      // attachment
//$mail->AddAttachment("/tmp/image.jpg", "new.jpg"); 
$mail->IsHTML(true);                               // send as HTML

$mail->Subject  ="Unauthorized file changed today!";
$mail->Body     =  "" ;

$mail->AltBody  =  "This is the text-only body";

if(!$mail->Send())
   {
     exit();
   }
}

 if ((file_exists($error_monitor_file)) && $hour == "00")
 {
   unlink($error_monitor_file);
 }
 fclose($fh3);
 exit();
?>

Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at /home/bakerde1/public_html/oceangamer.com/login.php:1) in /home/bakerde1/public_html/oceangamer.com/login.php on line 2

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/bakerde1/public_html/oceangamer.com/login.php:1) in /home/bakerde1/public_html/oceangamer.com/login.php on line 2

These are my error messages, here is my code. I don't know if it is the UTF-8 code at the start, but if it is can anyone recommend a binary editor to remove this. If it isn't what is the problem?

<?php  
  session_start();



$username = $_POST['username'];
$password = base64_decode($_POST['password']);


$errors = array();

if($username == 'User Name' || $username == ''){
  $errors[] = 'Please enter a valid username';
}

if($password == 'Password' || $password == ''){
  $errors[] = 'Please enter a valid password';
}

$link = mysql_connect("localhost","*****","******") or die ("Could not connect!");
mysql_select_db("chef");

$query = mysql_query("SELECT * FROM `users` WHERE `username`='$username'");
$numrows = mysql_num_rows($query);

if ($numrows!=0)
{
while($row = mysql_fetch_assoc($query))
{
$dbusername = $row['username'];
$dbpassword = $row['password'];
}
if ($username==$dbusername&&$password==$dbpassword)
{ 
$_SESSION['user'] = $username;
while ($row = mysql_fetch_array($res)) {
   $type = $row['Type'];
}
if ($type == "0") {
header("location: chefpanel.php");
}else{
header("location: restpanel.php");
}
}
else
 $errors[] = 'Username or Password Incorrect';
}
else
 $errors[] = 'Username or Password Incorrect';
?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

Hi girls and boys

I am trying to set a variable if a session OR a cookie has been set, but am unsure on how to write the statement...

if (isset($_SESSION['name'])||isset($_COOKIE['name'])) {$variable = $_SESSION['name']||$_COOKIE['name'];}

Obviously not working there, but just need a pointer here.
any help is appreciated...

what would be the best way to
automate/force session destroy and cookie erase
i have a facebook iframe, with facebook login which gets the activation token
now the user is not logged out from the login script after he logs out of facebook.

any ideas how to force cookie timeout without a logout button?

im playing with
Code: [Select]
<?php
session_start();

//Global User Object Var
//loggedInUser can be used globally if constructed
if (isset($_SESSION['userCakeUser'])) {
$obj = casttoclass('stdClass', $_SESSION['userCakeUser']);
$_SESSION['userCakeUser'] = $obj;

$_SESSION['start'] = time(); // taking now logged in time
$_SESSION['expire'] = $_SESSION['start'] + (1 * 60) ; // ending a session in 1 minute
}
if(isset($_SESSION["userCakeUser"]) && is_object($_SESSION["userCakeUser"]))
{
$loggedInUser = $_SESSION["userCakeUser"];
}
?>

I have several "sites" located in my html directory, and each has a "general" access point and an "administrator" access point:

/var/www/html/site1/index.php
/var/www/html/site1/administrator/index.php
/var/www/html/site2/index.php
/var/www/html/site2/administrator/index.php
/var/www/html/site3/index.php
/var/www/html/site3/administrator/index.php

All sites are similar except that data will be specific to site1, site2, or site3, etc.   Users who log onto /var/www/html/siteX/index.php are totally unrelated to those who logon to /var/www/html/siteX/administrator/index.php, will have different logon credentials, are stored in different DB tables, and each should have their own session.  If a user logs off of either the general or administrator site, it should not effect the other site even if they were previously logged on to both on the same PC (and of course not effect other sites). When a user logs off, I would like to destroy their previous cookie and associated session.  Users for either will only use https.  I am using Apache to rewrite https://www.mysite.com/ to https://mysite.com/.  While I named the administrator site "administrator" above, the administrator user has the ability to change the directory name.   I am thinking I need to use session_set_cookie_params to specify where I wish the session cookie to be stored since /var/www/html/siteX/administrator/index.php is a sub-directory to /var/www/html/siteX/index.php, but am not really sure.  Sorry for the cryptic post, but I am not very well versed in this subject. How would you recommend setting up cookies/sessions for this scenario?  Thank you

What I'm trying to accomplish is your average session login w/ a cookie-based "remember me" feature.

I can log in fine, I can set cookies, I can access those cookies, and I can use that data to log in just as if the user had logged in manually.

The problem is logging out. But the bigger problem is figuring out why.

You see, it works perfect. It logs in and it log out, so long as I am outputting data to the page. I was outputting a session variable and the cookies I set to make sure they were all working right; and they were. But then as soon as I disable those echoes, all of a sudden it won't log out anymore.

So then I turn them on to see what the data says and BAM, I'm logged out. I log back in fine, I log back out fine, so I turn em off again.

I log in fine. I can't log out. I try multiple times. I close my browser and open a new one. Still logged in. I try a few more times, still logged in. I turn the output back on, load the page again and I'm logged out.

So... WTF? (my code to follow)

in this page
 http://maximaart.com/newscp/
i have this problem
Code: [Select]
Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/maximasy/public_html/newscp/index.php:1) in /home/maximasy/public_html/newscp/index.php on line 2

my source code is

<?php
session_start();
include_once("config.php"); 
include_once("functions.php");
$errorMessage = '';
if (isset($_POST['txtUserId']) && isset($_POST['txtPassword'])) {
if ($_POST['txtUserId'] === "$user" && $_POST['txtPassword'] === "$pass") {
// the user id and password match,
$_SESSION['basic_is_logged_in'] = true;
require("main.php");
exit;?>

I am having trouble resolving an error.

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/s519970/public_html/header.php:27) in /home/s519970/public_html/admin/login.php on line 2

 What I can gather is I can't use "header (Location: 'admin.php')" after i've used session_start(). I have tried to replace the header (Location: 'admin.php') with this:

                echo "<script>document.location.href='admin.php'</script>";
      echo "<script>'Content-type: application/octet-stream'</script>";

I've been trying to read up on solutions but haven't been able to get it sorted. If anyone can offer some advice that would be greatly appreciated as im new to php.

Code: [Select]
<?php
  session_start();
  if(isset($_SESSION['user']))

                echo "<script>document.location.href='admin.php'</script>";
echo "<script>'Content-type: application/octet-stream'</script>";
?>

<div id="loginform">

<form action="dologin.php" method="post">
<table>
<tr>
<td><span>Username:</span></td>
<td><input type="text" name="username" /></td>
</tr>
<tr>
<td><span>Password:</span></td>
<td><input type="password" name="password" /></td>
</tr>
<tr>
<td colspan="2" align="right"><input type="submit" name="login" value="Login" /></td>
</tr>
</table>
</form>

</div>
I have tried using require_once('yourpage.php'); before my <head></head> tags in the header document where I've specified the html information but this doesn't seem to work. I've been advised to use ob_start("ob_gzhandler"); but I am not sure how to implement this.

Any advice is greatly appreciated!

hi everyone.

i'm wondering what the best way is to create a session variable and pass it to an iframe.
i need to do something along these lines, but it doesn't seem to pass the ID. Any hints on how i should accomplish this?

Code: [Select]
session_start();
  $_SESSION['ID']=$_GET['ID']; // id from previous page
$ID=session_id();

 <iframe src="iframepage.php?ID=<?php echo $ID; ?>" style="width:680px; height:200px;" noresize="noresize" frameborder="0" border="0" scrolling="Yes" allowtransparency="true" /> </iframe>

I'm making a simple login system with MySQL and PHP (very simple, I'm just starting with PHP). The MySQL portion is done, but I need to ensure only people who are logged in can see certain content.

To check if people are logged in, my website checks that they have the $_SESSION['user'] variable set. If it is set, then it lets them continue through the website, if not, it tells them to login. Is that enough security, or can people simply inject a session cookie into their browser to spoof that they are logged in?

My idea was to generate a session key cookie when they login (just a random string of letters and numbers) and store that in the database, then on every page, check to make sure their session key is the same thing that's in the database. Is this necessary? It seems expensive.

Just curious how other people feel about this.  I am working on an application where a lot of info is pulled from MySQL and needed on multiple pages.     Would it make more sense to...   1.  Pull all data ONCE and store it in SESSION variables to use on other pages    2.  Pull the data from the database on each new page that needs it   I assume the preferred method is #1, but maybe there is some downside to using SESSION variables "too much"?   Side question that's kind of related:  As far as URLs, is it preferable to have data stored in them (i.e. domain.com/somepage.php?somedata=something&otherdata=thisdata) or use SESSION variables to store that data so the URLs can stay general/clean (i.e. domain.com/somepage.php)?   Both are probably loaded questions but any possible insight would be appreciated.   Thanks! Greg
Edited by galvin, 04 November 2014 - 10:30 AM.

Evening!

I've been iffing and ahhing over this and well im not too sure, hence the post.

Code: [Select]
// Redirects if there is no session id selected and echos the error on the previous page
if(!isset($_GET['get']) || ($_GET['getget'])){
header("Location: #.php?error");
}
So it should simply check if get is set if it isnt then see if getget is set?

If not redirect and show the error.

Now ive tried it and even when get/getget is set it still redirects, probably something silly. Care to share anyone?

Harry.