How to properly "delete" a Cookie in PHP

0
votes

I have created a PHP and Cookie-based Login and Logout system for the admin page of a WebApp I am working on. Issue is when I refresh the page more than 2 or 3 times when I am Logged In, the Log Out function doesn't work properly, and keeps me "Logged In" if I attempt to load an admin page after I have "Logged Out". I am not certain if this is a browser setting, or something I am coding incorrectly.

Login PHP Code:

setcookie("password","$thepassword");

Logout PHP Code:

unset($_COOKIE['password']);

setcookie('password', null, -1, '/');

Any ideas welcome. :) Thanks~

3
phpcookiessetcookie
should you really be storing the users password as a cookie? - Darren
you should store user details in session not cookies! - Albert Kozłowski
@dbh I am, I just modded the code so you guys wouldn't be confused. I am transferring the data from the database to variables, so it really doesn't matter. - Uncle Nerdicus
@AlbertKozłowski I'm open minded, why do you think a session would be more beneficial? - Uncle Nerdicus
@UncleNerdicus Okay just checking, I'm with ALbert on this one though. - Darren

3 Answers

4
votes

A few seconds of google search would save you the hassle of asking a question, thought its already been answered here before, check this

I would also mention that storing users passwords in a cookie is a crime! please use sessions for such an ocassion.

1
votes

You can always assign the cookie a null value:

setcookie("user", NULL);

However, cookies tend to be a rather insecure way of storing user data. I strongly recommend using sessions in stead. Keep in mind that users can change the value of cookies, but not sessions. Then to log out you can use session_destroy()

Also, try refreshing the page after the cookie is unset.

0
votes

I solved my issues by converting the script to use Sessions, and not Cookies.

Thanks for the advice guys. :)