tags:

views:

38

answers:

3

I'm making a site, and will be allowing guests to vote/comment. How should I go about storing the user info?

I wouldn't like the info to be cleared if someone deletes the cookie (SO handles guest users via cookies I guess). If someone clears cookies and changes the ip at once, then only should the guest user info should be lost.

Should I use sessions in php for this?

A: 

Cookies can be storable longer than sessions. Sessions will be die when browser window is closed.

Osman Üngür
A: 

Using a SQL database is the only way you're going to have data that keeps on the server, and can be viewed by other users. AS you already know MySQL is popular but if you don't have any database available, SQL Lite is a good choice is it doesn't require you to install anything on the server, just have SQL Lite enabled in the PHP confic.

Create a 'users' table in your database, store the password as a SHA-256 hashed value (not raw, not MD5). When they login make use of PHP sessions via session_start() and upon a successful login make sure to use session_regenerate_id() too (it prevents a known exploit for stealing logins).

PHP sessions are considered a simple and secure way to implement logins, trying to re-invent the wheel manually with your own cookies will lead to security problems and more work for you.

TravisO
A: 

To persist user information reliably you should store it on your server with some kind of user id based on the cookie etc. Php sessions only support sessions, so are helpful to maintain identity within a session. Once a user closes his browser and starts it up again the PHP session may be gone. Similarly cookies may be gone as well.

Relying on IPv4 addresses however is not going to get you very far. Even disregarding people on dynamic IP addresses (every time they access the internet they have a different ip) there are plenty of people sharing IP's through NAT. You don't want to share a user for an entire office of people do you?

So in short, you could use PHP sessions in addition to your normal cookie (in case the user disables cookies) but you cannot get his identity back if he is anonymous and he decides to delete his cookies. Remember that under water PHP sessions work by means of cookies (and fall back request parameters only when cookies are disabled)

Paul de Vrieze