Users, Registration, and Authentication Remember me Our current implementation of an authentication system relies on SESSION data, which expires at the end of a user's session (either a specific time-limit set by the server, or when the user closes their browser, whichever occurs first). Many users want to be remembered when they log in to certain sites they use on a regular basis, to save the trouble of continually logging in every day, or even several times a day. This can be achieved by combining sessions with cookies. However, as cookies last for longer periods of time and are stored on the. | Users Registration and Authentication Remember me Our current implementation of an authentication system relies on SESSION data which expires at the end of a user s session either a specific time-limit set by the server or when the user closes their browser whichever occurs first . Many users want to be remembered when they log in to certain sites they use on a regular basis to save the trouble of continually logging in every day or even several times a day. This can be achieved by combining sessions with cookies. However as cookies last for longer periods of time and are stored on the user s computer whereas sessions are stored on the server cookie authentication will need to be more advanced. One option would be to store a random salted hash of the time the user logged in within the cookie. If we simply relied on the user ID being stored in the cookie it would be easy for users to create fake cookies and thus take control of other users accounts. Help I ve forgotten Some of our users will probably forget their login details particularly if they haven t used our site for a while. If we don t have provisions for this then we will lose users. There are three types of reminder we should include Username reminder Password reminder Resend e-mail verification message Let s look at implementing these features in our authentication controller. Username If the user forgets his her username they simply supply their e-mail address and we e-mail them a reminder private function forgotUsername if isset _POST email _POST email e this- registry- getObject db - sanitizeData _ POST email sql SELECT FROM users WHERE email e this- registry- getObject db - executeQuery sql if this- registry- getObject db - numRows 1 data this- registry- getObject db - getRows email the user --------------- F Download from Chapter 3 this- registry- getObject mailout - setTo _ POST email this- registry- getObject mailout - setSender this- registry- getSetting adminEmailAddress this- .
