I have been using newly downloaded version of IE 6.xx.xxxx for 3 weeks. Anyway cookies are switched off there on default. You should understand that it’s impossible to make user change his settings to get to your site. It will be called ‘dropping of the security level’. Some very brave users are going to submit you their Internet passwords but in the rest of cases they cannot be forced to set up dropped level. And so the sites using cookies are going to stop existing as far as the technology isn’t proper…

Tell me, please, why do you use cookies for the things like these when you have sessions? It seems to me that after appearance of sessions in PHP cookies are needed only to ‘recognize’ a customer after he returns to the site in some time.

I didn’t realize which authorization method is more secure – cookies or sessions 

P.S. You say that cookies are particular case of sessions. But sessions can be used without cookies as well.

I like this article: it is short and clear (in spite of the fact that I started working with PHP not so long time ago).

With best regards

I’ve discovered a lot of new things!
It’s a pity that HEADER() function is incompatible with my data base on PostgreSQL (or with my Internet Explorer)

Function header cannot be out of order due to PostgreSQL.
Why don’t you create user session with login? And not to make validation in the data base on each page but only to look if there is a ‘user’ login in the session variable or not? In order to disable insertion of user variable through form we take it from massive HTTP_SESSION_VARS[].

I have a question. I used schedule with cookies described in the previous article. I’ve added to this logout.php script which nulls all the cookies (like cookie_login, cookie_passwd). But if I push Back button after logout.php, I gain access to the previous page again although there shouldn’t be anything like this. Help me, please!

I make it like this:

class Session {...
function set($varname, $value) {
if (!session_is_registered($varname))
if (!session_register($varname)) return false;
$HTTP_SESSION_VARS[$varname] = $value;
return true;
}

function get($varname) {
return $HTTP_SESSION_VARS[$varname];
}...

Of course, I understand that if global sessions are allowed, it is possible to write it directly (like $varname = $value and it works in this way)...
BUT I need it via $HTTP_SESSION_VARS and I don't understand why it doesn't function...

What is Request.cookies collection and what is its difference from ordinary cookies?

# phpMyAdmin MySQL-Dump
# version 2.3.1
# http://www.phpmyadmin.net/ (download page)
#
# Host: localhost
# Creation time: 12/4/2002, 17:50
# Server version: 3.23.52
# PHP version: 4.2.3
# Data base: `test`
# --------------------------------------------------------

#
# Table structure `user_logged`
#

CREATE TABLE user_logged (
user_id varchar(128) NOT NULL default '',
login varchar(128) NOT NULL default '',
auth int(6) NOT NULL default '0',
timeout int(6) NOT NULL default '0',
last_query int(6) NOT NULL default '0',
ip varchar(128) NOT NULL default '',
PRIMARY KEY (user_id)
) TYPE=MyISAM;

#
# Data dump of the table `user_logged`
#

INSERT INTO user_logged VALUES ('e65d67d227de6f52c52af1b18533fb1c', 'admin', 1, 3600, 1039010817, '127.0.0.5');
# --------------------------------------------------------

#
# Table structure `user_users`
#

CREATE TABLE user_users (
login varchar(128) NOT NULL default '',
passwd varchar(128) NOT NULL default '',
auth int(6) NOT NULL default '0',
PRIMARY KEY (login,login)
) TYPE=MyISAM;

#
# Data dump of the table `user_users`
#

INSERT INTO user_users VALUES ('admin', '43e9a4ab75570f5b', 1);
INSERT INTO user_users VALUES ('root', '67457e226a1a15bd', 2);