Geek Answers Handbook

Mysql real escape string and cookies

Is there any reason this is bad form? The only user input on the page is

// Set username and password from cookies $username = mysql_real_escape_string($_COOKIE["username"]); $password = mysql_real_escape_string($_COOKIE['password']);

I am REALLY new to the idea of ​​disinfection. Is there any reason this is a terrible way to do something?

0
source share
1 answer

NEVER, NEVER store user data in cookies!

Here is what I suggest:

  • save user id in cookie
  • create a special token and hash + salt and save them in cookies.
  • store everything in the database
  • receive data from cookies at each page load and look for them in the database
  • if not found, then log out
  • change token at every page load
+1
source

More articles:


All Articles