PHP Logout Script

Question

I'm trying to create a PHP logout script, however, as soon as I implement it, the page just gets redirected to the page after login. Here is the code:

Connect.php

<?php 
    session_start();
    $link = mysql_connect("localhost", "database_name", "database_pass") or die(mysql_error());
    mysql_select_db("database_name") or die(mysql_error());

    if(isset($_COOKIE['username'])) 
             $_SESSION['username'] = $_COOKIE['username'];
 ?>

Logout.php

<?php
    include("connect.php");
    session_start();
    session_destroy();
    $username = $_SESSION['username'];
setcookie($username, time()-3600);  
    header("Location: index.php");
    die;    
?> //immediately after here, instead of going to index.php(the login page), it goes straight to the page that would appear after if the user had logged in(control_panel.php).

Any ideas? Thanks!

You're better off finding a tutorial online of how to create an auth script. As noted above by @Petah, your method is insecure. — Daedalus
– Daedalus, Commented Jul 23, 2012 at 6:03
is "the page that would appear after if the user had logged in" also index.php? If yes, you have to disable browser caching — Alvin Wong
– Alvin Wong, Commented Jul 23, 2012 at 6:03
@Petah, what do you mean by "sets his cookie username to root"? — Andrew
– Andrew, Commented Jul 23, 2012 at 6:04
@user1340238, the cookies are stored and sent by the client. If you read the username from the cookie, then the client can send you any username he wants. — rid
– rid, Commented Jul 23, 2012 at 6:09

Petah · Accepted Answer · 2012-07-23 06:06:22Z

2

Have a look at this page: http://blog.ircmaxell.com/2011/08/security-review-creating-secure-php.html

It goes through "Creating a Secure PHP Login Script" completely. Your current solution has many security issues.

edited Jul 23, 2012 at 6:06

answered Jul 23, 2012 at 6:02

Petah

46.2k30 gold badges161 silver badges217 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Mr. Alien · Accepted Answer · 2012-07-23 06:23:18Z

1

Your code is wrong I guess, the problem lies here..

In your logout.php you are expiring a cookie after you are unsetting your session, your cookie is not getting expired.

And in connect.php you are using this condition to set a session again and it sets because cookie is still in the user's browser

if(isset($_COOKIE['username'])) 
            $_SESSION['username'] = $_COOKIE['username'];

So Instead of doing this :

setcookie($username, time()-3600);

Do this :

 setcookie($username, "", time()-3600);

edited Jul 23, 2012 at 6:23

answered Jul 23, 2012 at 6:07

Mr. Alien

158k36 gold badges307 silver badges287 bronze badges

2 Comments

Abdulaziz Over a year ago

he's actually removing the cookie, since he's setting a time in past time() - 3600.

Mr. Alien Over a year ago

@AzizAG may be his cookie is lying in the browser or may be he must be setting a cookie on index.php

Collectives™ on Stack Overflow

PHP Logout Script

2 Answers 2

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related