Cookie prevention Imitation Safety explanation _php tutorial

Before we just write PHP, do backstage, need administrator authentication. This is generally done with cookies, especially PHP enthusiasts who have just contacted PHP:
admin/login.php

if (User name&&Password is correct) {
Setcookie(' admin ',1, Time()+36400);
Echo' Login successful ';
}

if ($_cookie[Admin] == 1) {
Echo' have permission ';
}

However, this can be a major security risk, many browsers may directly modify the cookie, or directly in the system to modify.

As long as the cookie is forged, then the administrative authority gets

To be safe, do this:

if (User name&&Password is correct) {
Setcookie(' userid ',ID of the user in the system, Time()+36400);
Setcookie(' Userpass ',User's 32-bit MD5 password in the system, Time()+36400);
Echo' Login successful ';
}

To do this when judging permissions:

if ($_cookie[userid]) {
$query= mysql_query(Select* user table where UserID= ' $_cookie[userid] ' andUserpass= ' $_cookie[userpass] ');
$row= Mysql_fetch_array($query);
if ($row[Rank] <>1) {
Echo' no permissions ';
}
}

So it doesn't work to fake cookies.

http://www.bkjia.com/PHPjc/629572.html www.bkjia.com true http://www.bkjia.com/PHPjc/629572.html techarticle before we just write PHP, do backstage, need administrator authentication. Generally use cookies to do so, especially the PHP enthusiasts who just contacted PHP: admin/login.php if (username password is ...)

