Member Avatar for himanjim

Hey friends I've a doubt regarding my password authentication code given below
If we use session _start function one need not use the cookies as

     $_SESSION['user'] = $username;
     $_SESSION['password'] = $password;

functions do the same job that cookies would have done so my cookies code is just a clutter??

Here's my code

<?PHP
session_start();
?>
<?php
include "connect.php";
include 'var.php';
print "<link rel='stylesheet' href='http://127.0.0.1/styles/styles.css' type='text/css'>";
if (isset($_POST['submit'])) // name of submit button
{
    $username = $_POST['username'];
    $password = $_POST['password'];
    $password = md5($hash . md5($password));
    $query = "SELECT* from moderators where username='$username' and password='$password'";
    $usercheck1 = mysql_query($query) or die(mysql_error());
    $usercheck2 = mysql_num_rows($usercheck1);
    if ($usercheck2)
    {
        $_SESSION['user'] = $username;
        $_SESSION['password'] = $password;
        if ($_POST['remember'])
        {
            $memberid = $result2[username];
            $passkey = $result2[password];
            [COLOR=Green]$cookie1 = "[0]";
            $cookie2 = "[1]";
            $cookie3 = "$cookiename$cookie1";
            $cookie4 = "$cookiename$cookie2";
            setcookie("$cookie3", "$memberid", time() + 7776000);
            setcookie("$cookie4", "$passkey", time() + 7776000);[/COLOR]
        }
        print "<center>";
        print "<table class='tborder' cellpadding='6' cellspacing='1' border='0'>";
        print "<tr><td class='panelsurround' align='center'><center>Logged In</center></td></tr></table></center>";
        print "<META HTTP-EQUIV = 'Refresh' Content = '2; URL =http://127.0.0.1/register.php'></center>";
    }
    else
    {
        print "<center>";
        print "<table class='tborder' cellpadding='6' cellspacing='1' border='0'>";
        print "<tr><td class='panelsurround' align='center'><center>Invalid username or password</center></td></tr></table></center>";
        //print "<META HTTP-EQUIV = 'Refresh' Content = '2; URL =http://127.0.0.1/login.php'></center>";

    }
}
?>
Edited by mike_2000_17 because: Fixed formatting
  • 3 Contributors
  • 3 Replies
  • 201 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Puckdropper

Dani AI

Generated

Short answer: session_start() does not make cookies useless. Sessions store data on the server, but PHP (by default) still sends a small cookie (the session id) to the browser so PHP can find that server-side data on the next request. A session cookie is usually non‑persistent (deleted when the browser closes), while a "Remember me" feature requires a persistent cookie and a secure server-side mechanism.

A few practical rules and security points:

  • Never store the plaintext password in a session or in a cookie. Store a user id and minimal state (roles, preferences).
  • Protect sessions with session_regenerate_id(true) right after login to avoid session fixation.
  • For persistent login use a randomly generated token (not the password) stored hashed in your database and set only the raw token in a Secure, HttpOnly, SameSite cookie. On return, compare the hashed token with hash_equals, issue a new session, and rotate the token.
  • Use modern password handling (password_hash() / password_verify()), not MD5 or custom weak schemes.
  • If sessions seem to disappear: call session_start() before output, check cookie domain/path/secure flags, verify server time, and on multi-server setups use shared session storage (Redis, memcached, or DB) or sticky sessions.

Example pattern (short):

session_start();
session_regenerate_id(true);
$_SESSION['user_id'] = $userId;

// create persistent token for "remember me"
$token = bin2hex(random_bytes(32));
$tokenHash = hash('sha256', $token); // store $tokenHash + expiry in DB
setcookie('remember', $token, [
  'expires'=>time()+60*60*24*30, 'path'=>'/', 'httponly'=>true, 'secure'=>true, 'samesite'=>'Lax'
]);

Credit: was right that sessions are generally better for sensitive data; and others are also correct that browser behavior matters — browsers can remove cookies (including the session cookie), so choose session vs persistent cookie depending on whether you need "remember me" behavior.

Recommended Answers

All 3 Replies

Member Avatar for ryan_vietnow

I think it's better to use sessions rather than cookies because cookies can be deleted by the user while sessions can not be deleted.
Me,I don't use cookies anymore.
Just my opinion....

Member Avatar for Puckdropper

Cookies are bits of information that will remain accessible to the browser across many openings and closings of the browser. For example, the "Remember me" functions of websites use sessions. Sessions, OTOH, are only remembered while the browser is opened. If the browser is closed, the session ID will be different and the user will have to do things like log in again.

For the record, Mozilla lets me delete the session ID when I want to. It's just another cookie in Mozilla's point of view.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.