[PHP] Cookies..

[Joe]

Here's my three-hour's worth of work on cookies. I never really figured out how to delete a cookie so ?logout won't work. You have to redirect yourself to ?info manually, and for some reason the cookie explode function won't work. Anyhow, here it is (test).

[Warrior]

You use set_cookie(blah, "", time);

[iago]

You use set_cookie(blah, "", time);

Isn't that what he's doing?

[rabbit]

No, he does nothing:

Code: [Select]

        case "logout":        // logging out, duh
            break;
Secondly, md5 blows.  Change them to SHA1.
You should also call error_reporting(E_ALL) and do an isset() check on your get variables.  You should also set a cookie expiration date.  Setting cookies good until the browser closes is a stupid thing to do, and can be replaced by the $_SESSION superglobal (that's what it was made for).

Nextly, you should return all of your strings, and never print from functions, unless you're doing OOP (which you're not).

Furthermore, hange the password box to a password type.  Also, "Translate"?  WTF?

You have a problem:

Cookie: a722c63db8ec8625af6cf71cb8c2d939 test1
Logged in as test1
Account doesn't exist.

I can't be logged in with a non-existant account.  It doesn't make sense.  You could be tracing these problems out with error_reporting(E_ALL);

[iago]

You're being overly picky for no reason. 

No, he does nothing:

Code: [Select]

        case "logout":        // logging out, duh
            break;

I thought he meant in general, I didn't realize he was talking about the logging out.

Secondly, md5 blows.  Change them to SHA1.

In this context, md5 vs sha1 makes absolutely no difference.

You should also call error_reporting(E_ALL) and do an isset() check on your get variables.

Useful advice for developing, in general, but he's releasing the software so setting it to E_ALL would be annoying for others.

  You should also set a cookie expiration date.  Setting cookies good until the browser closes is a stupid thing to do, and can be replaced by the $_SESSION superglobal (that's what it was made for).

That's true, but then this wouldn't be a demonstration of cookies, would it?  There's nothing wrong with a login cookie expiring at close, even if session is better.  It's definitly not "stupid". 

Nextly, you should return all of your strings, and never print from functions, unless you're doing OOP (which you're not).

Both ways are fine. 

Furthermore, hange the password box to a password type.

Again: demonstration. 

You have a problem:

Cookie: a722c63db8ec8625af6cf71cb8c2d939 test1
Logged in as test1
Account doesn't exist.

I can't be logged in with a non-existant account.  It doesn't make sense.  You could be tracing these problems out with error_reporting(E_ALL);

You don't have to be an asshole when you report a bug. 

[Joe]

As for E_ALL, I was expecting the programmer who implements a changed version of this to add their own error checking, etc. Also, printing from functions was just the quick-and-sloppy approach I took to this, trying to get the concept to work even if it required breaking coding style (which can always be fixed later).

Also, you can very well be logged in from a nonexistant account. Hack your cookies file and put in "ffffffffffffffffffffffffffffffff acct_that_doesnt_exist".

[Warrior]

You're mutilating PHP..stop it.

[rabbit]

You're being overly picky for no reason. 

I'm criticizing his code and trying to help him learn how to better implement his ideas in PHP.  I'm not trying to be mean or anything.

Secondly, md5 blows.  Change them to SHA1.

In this context, md5 vs sha1 makes absolutely no difference.

md5 is infitely easier to collide than sha1, and if someone hijacked an admin cookie, they could easily log in as the superuser.

You should also call error_reporting(E_ALL) and do an isset() check on your get variables.

Useful advice for developing, in general, but he's releasing the software so setting it to E_ALL would be annoying for others.

I keep E_ALL on on all of my projects, and trap the errors, though it is just personal preference.

  You should also set a cookie expiration date.  Setting cookies good until the browser closes is a stupid thing to do, and can be replaced by the $_SESSION superglobal (that's what it was made for).

That's true, but then this wouldn't be a demonstration of cookies, would it?  There's nothing wrong with a login cookie expiring at close, even if session is better.  It's definitly not "stupid". 

I'm just saying it would be a more effective demonstration of cookies if he did something that only cookies could do, like carrying a login over multiple sessions.

Nextly, you should return all of your strings, and never print from functions, unless you're doing OOP (which you're not).

Both ways are fine. 

Gah..I supposed, but it bugs me.

Furthermore, hange the password box to a password type.

Again: demonstration. 

It's what the "password" type is for.

You have a problem:

Cookie: a722c63db8ec8625af6cf71cb8c2d939 test1
Logged in as test1
Account doesn't exist.

I can't be logged in with a non-existant account.  It doesn't make sense.  You could be tracing these problems out with error_reporting(E_ALL);

You don't have to be an asshole when you report a bug. 

Wasn't trying to be.  I was just pointing out that something went wrong and conflicting messages were printed.  Anyway, that "could" is should*, my bad.

[Sidoh]

Tip: use <?php.  I think I've told you that before.

[rabbit]

Yeah, I completely overlooked that.

<? is used by XML as well, so you should always do <?php and <?xml, instead of just plain old <?.  Also, though it's not *required*, php?> works just as well, but isn't all that helpful unless you're mixing XML and PHP

[Warrior]

Nextly, you should return all of your strings, and never print from functions, unless you're doing OOP (which you're not).

Both ways are fine. 

I strongly suggest learning to seperate core code from display code. It applies in almost every programming language and is a plus for organization. It's a bitch to upgrade code which is riddled with a bunch of HTML. Please, do yourself a favor. Both ways are not fine. I'm warning you.

[Joe]

This was a demonstration of how cookies can be used, not how to write PHP.

[Warrior]

You should always write good PHP. That's a bad demonstration at most.

[Sidoh]

That's like writing an English paper on how to use semicolens, but failing to use other aspects of the language correctly.  It's just stupid.

[Chavo]

<insert generic comment about poor programming habits here>

actually, I'm sure I would be saying more than that if it was in a language that I knew better

[Sidoh]

<insert generic comment about poor programming habits here>

actually, I'm sure I would be saying more than that if it was in a language that I knew better

*grin*

Oh, I missed the entire discussion about seperating display output from other portions of a script.. yeah, I absolutely agree with warrior.  One way may work, but it's a huge fucking pain in the ass to upgrade code when you're stuck with static display output.  I don't necessarily agree that this sort of thing warrants such coding techniques, but it wouldn't hurt to practice these sorts of things, even on such a simple project.

[iago]

Of everything, there are only a couple points that I want to pursue:

I'm criticizing his code and trying to help him learn how to better implement his ideas in PHP.  I'm not trying to be mean or anything.

There's a way to criticize code to help, and a way to criticize to be mean.  I suspect that your original post reflected the latter, but I could be mistaken. 

md5 is infitely easier to collide than sha1, and if someone hijacked an admin cookie, they could easily log in as the superuser.

The only way to find a collision is to control two different plaintext messages and force them to hash to the same.  Both SHA1 and MD5 are vulnerable to that, but that only affects very rare cases.  In general, to store password or other sensitive data in a non-reversable form, MD5 and SHA1 are still fairly strong. 

Yes, there is a slightly higher chance that "Lovecraft" and "Cthulhu" will collide on MD5 than on SHA1, but it's such a miniscule difference that it's not worth considering. 

You really shouldn't store the password in a cookie in any form, technically.  I tend to use a disposable token, like the session variable, that expires when the cookie expires. 

[Chavo]

I'm sorry that I have to do this, a little part of me just died on the inside:

criticize*

There are only two commonly mispelled words that bug me, now you know one

[iago]

I'm sorry that I have to do this, a little part of me just died on the inside:

criticize*

There are only two commonly mispelled words that bug me, now you know one

Yeah, I knew it looked wrong, so I switched the s and z.  It still looked wrong, so I just gave up.  I hate the word. 

[Sidoh]

I'm sorry that I have to do this, a little part of me just died on the inside:

criticize*

There are only two commonly mispelled words that bug me, now you know one

Wut iz teh other won?

[Chavo]

If I told you I'd have to kill you

[iago]

In other words, start intentionally misspelling difficult-to-spell words until he speaks up.

[Chavo]

Haha, that would work if there were more than the two that bothered me.  It doesn't help your cause to spam words that don't bother me.

I'll give it up for a really good cookie or a fresh beer.

[rabbit]

How about a pwncookie, or maybe even a whole batch of pwncookies?

[iago]

Haha, that would work if there were more than the two that bothered me.  It doesn't help your cause to spam words that don't bother me.

I'll give it up for a really good cookie or a fresh beer.

No, but evenchally we're bound to find the word.

[Sidoh]

I agree iago, we must manetane our efferts.

[Chavo]

lol@ manetane

rabbit, those cookies don't have nearly enough chocolate chips.  Who do you take me for? A non cookie-afficianado? Honestly.

[rabbit]

They have enough, trust me (or did, before I ate them a few months ago).  The chips consolidate towards the bottoms due to the way the dough spreads in the oven.

[Chavo]

Damn't.  Now I'm hungry

[d&q]

lol@ manetane

rabbit, those cookies don't have nearly enough chocolate chips.  Who do you take me for? A non cookie-afficianado? Honestly.

Warez the fudge? Its speled aficionado! Dunt b a hippo-crit!

[Chavo]

I'm sorry that I have to do this, a little part of me just died on the inside:

criticize*

There are only two commonly mispelled words that bug me, now you know one

I know its hypocritical! I only care when its those two words

[deadly7]

I hate to do this:
it's*

Now you one of the words that wen mispelled pisses me of.

[Joe]

deadly is a hypocrite. He has horrible spelling, and I was not able to figure out what that "you" is doing in his sentence.

[Sidoh]

Now you one of the words that wen mispelled pisses me of.

Oh the irony... grammatical errors and a spelling error?

* misspelled.

I would much rather have someone misplace, misuse or forget an apostrophe than use a sentence which is totally grammatically incorrect.

[Warrior]

I think it was intentional.

[Sidoh]

I think it was intentional.

I don't.  Even if he confirms it, I'll still have doubt.

[Joe]

Now you one of the words that wen mispelled pisses me of.

Know you one of the words that, when misspelled, pisses me off.

Shakesperian English.

[rabbit]

Not even close to Shakespearean.  First, he would reference sex and mock someone's mother at least once.  Second, it would rhyme.  And third it would be grammatically correct.

[iago]

Not even close to Shakespearean.  First, he would reference sex and mock someone's mother at least once.  Second, it would rhyme.  And third it would be grammatically correct.

Your first point sucks.

Not everything Shakespeare wrote rhymes, only small areas. 

Shakespearean grammar is quite different from modern grammar, so your third point is debateable, at best. 

[rabbit]

Then add point four: it would be a good insult.

[deadly7]

Now you one of the words that wen mispelled pisses me of.

Oh the irony... grammatical errors and a spelling error?

* misspelled.

I would much rather have someone misplace, misuse or forget an apostrophe than use a sentence which is totally grammatically incorrect.

That was the whole point of my sentence.  I added random words.  I don't even remember what the hell I was trying to say.