I have a login form in php and remember me checkbox. I want when user enters username and password and checks that remember me checkbox to automatically be logged in for as long as he doesn't click logout button. I am trying to achieve that using cookies and sessions, altough some say that it is not safe, I don't have other options like tokens and such because I don't have access to tables and to change them. Any help is appreciated. Here is my code.
login.php
<?php
session_start();
require 'connection.php';
$username_error = "";
$password_error = "";
$captcha_error = "";
if($_SERVER['REQUEST_METHOD'] == 'POST')
{
if(isset($_POST['submit']))
{
$v_username = $_POST['username'];
$v_password = $_POST['password'];
$v_captcha = $_POST['captcha'];
$remember = $_POST['remember'];
function validation($form_data)
{
$form_data = trim(stripcslashes(htmlspecialchars($form_data)) );
return $form_data;
}
$username = validation($v_username);
$password = validation($v_password);
$captcha = validation($v_captcha);
if(empty($username))
{
$username_error = "<p>Please enter your username!</p>";
}
if(empty($password))
{
$password_error = "<p>Please enter your password!</p>";
}
if(isset($_POST['remember'])) {
setcookie('username', $username, time()+60*60*7);
setcookie('password', $password, time()+60*60*7);
}
if ($captcha == $_SESSION['cap_code'] && !empty($captcha)) {
if(!empty($username) && !empty($password)) {
$sql = "SELECT * FROM member_auth WHERE username = :username";
$stmt = $pdo->prepare($sql);
$stmt->bindValue(':username', $username);
$stmt->execute();
$user = $stmt->fetch(PDO::FETCH_ASSOC);
$cryptpass = $user['cryptpass'];
if($user === false){
$username_error = "<p>User doesn't exist</p>";
} elseif($user) {
$newPass = crypt($password, $cryptpass);
if($cryptpass == $newPass) {
$_SESSION['loggedin'] = TRUE;
$_SESSION['username'] = $user['username'];
header('Location: login_success.php');
}else {
$password_error = "<p>Password is not correct!</p>";
}
}
}
} else {
$captcha_error = "<p>Please enter correct captcha!</p>";
}
}
}
?>
<!DOCTYPE HTML>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Welcome to Love Her Feet</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">
<link rel="stylesheet" href="/login_assets/css/style.css">
<link href="https://fonts.googleapis.com/css?family=Raleway:300,400,500&display=swap" rel="stylesheet">
<link href="https://fonts.googleapis.com/css?family=Open+Sans:400,600&display=swap" rel="stylesheet">
<link rel="stylesheet" href="/login_assets/css/media.css">
<script src="/login_assets/js/jquery.min.js"></script>
<script src="/login_assets/js/modernizr.custom.js"></script>
</head>
<body>
<header class="clear hBlack">
<div class="jLogo"><a href="/"><img src="/login_assets/images/logo.png" alt=""></a></div>
</header>
<div class="logArea clear">
<form action="login.php" method="post">
<div class="logbox">
<div class="box clear">
<h2>Members Area</h2>
<div class="logTypes">
<input type=text name="username" class="logtextbox" placeholder="Username">
<span class="text-danger"><?php echo $username_error; ?></span>
<input type=password name="password" class="logtextbox" placeholder="Password"><br>
<span class="text-danger"><?php echo $password_error; ?></span>
<div style="width:100%; text-align:center">
<img src="captcha.php" style="width:150px; height:30px"/><a href="login.php" style="color:#668cff;"><p style="margin:4px 0px 0px 0px">Reload Image</p></a>
</div>
<div style="width:100%">
<label>Enter Captcha:</label>
<input type="text" name="captcha" id="captcha" maxlength="6" size="6"/>
</div>
<span class="text-danger"><?php echo $captcha_error; ?></span>
<div style="text-align: center">Remember my login: <input name="remember" type=checkbox value="y"></div>
</div>
</div>
<input type="submit" name="submit" value="submit" class="logBtn">
</div>
</form>
</div>
</div>
</body>
</html>
login_success.php
<?php
session_start();
if(isset($_SESSION["loggedin"])) {
echo "Welcome, {$_SESSION["username"]} <br>";
echo "<a href='logout.php'>Logout</a>";
} else {
header("Location: login.php");
}
logout.php
<?php
session_start();
session_destroy();
header("Location: login.php");
