Ensuring cookies are enabled and preventing false positives

Dev Shed Forums Sponsor:

November 26th, 2012, 12:39 PM

NotionCommotion

Contributing User

Join Date: Sep 2006

Posts: 1,464

Time spent in forums: 2 Weeks 1 Day 6 h 21 m 36 sec
Reputation Power: 526

Ensuring cookies are enabled and preventing false positives

I am using the followings script to ensure that cookies are enabled. If enabled is false, then displayForm() will display a warning message.

My difficulty is should the user inadvertantly included _c in their URL, it would incorrectly appear to the server that this is the second pass and cookies are not enabled.

How can this be changed? Thanks

PHP Code:


		
			
if(empty($_COOKIE) && !isset($_GET['_c']))

{

    syslog(LOG_INFO,'$_GET[_c] not received so set cookie.');

    setcookie('remember_user', 1, time()+3600);

    header('Location:'.$_SERVER['REQUEST_URI'].((strpos($_SERVER['REQUEST_URI'],'?') === false)?'?':'&').'_c=1');

}

else

{

    $enabled=!empty($_COOKIE);

    syslog(LOG_INFO,'$_GET[remember_user] received and cookie '.(($enabled)?NULL:'not ').'received.');

    //rememberUser() will be true if user previously indicated that he wanted to be remembered

    if($enabled && rememberUser()){header('Location: '.$_SERVER['REQUEST_URI']);}

    else {displayForm($enabled);}

}

November 26th, 2012, 12:42 PM

NotionCommotion

Contributing User

Join Date: Sep 2006

Posts: 1,464

Time spent in forums: 2 Weeks 1 Day 6 h 21 m 36 sec
Reputation Power: 526

Right after I posted this message, I thought "time"!

November 26th, 2012, 09:23 PM

NotionCommotion

Contributing User

Join Date: Sep 2006

Posts: 1,464

Time spent in forums: 2 Weeks 1 Day 6 h 21 m 36 sec
Reputation Power: 526

This is what I ended up doing. Any comments would be appreciated.

PHP Code:


		
			
 $time=time();

$url = preg_replace('/[?&]_c=.*$/', '', $_SERVER['REQUEST_URI']);

if(empty($_COOKIE) && !( isset($_GET['_c']) && (($time-$_GET['_c'])<2) ) )

{

    syslog(LOG_INFO,'A recent (2 second or less) $_GET[_c] not received so set cookie.');

    setcookie('remember_user', 1, time()+3600);

    header('Location:'.$url.((strpos($url,'?') === false)?'?':'&').'_c='.$time);

}

else

{

    $enabled=!empty($_COOKIE);

    syslog(LOG_INFO,'$_GET[remember_user] received and cookie '.(($enabled)?NULL:'not ').'received.');

    if($enabled && rememberUser()){header('Location: '.$url);}

    else {displayForm($enabled);}

}