$_REQUEST and setcookie Deprecated

Question

Please help me with this issue. I have a script and for the admin area it requests a file "login.php" with the following code:

<?
if($_COOKIE["ok"]==1){
    setcookie("user",$_REQUEST["name_theuser"]);
    setcookie("tipe",$_REQUEST["thetipe"]);
}else{
    echo "<script>document.location.href='disconnect.php';</script>";
}
echo "<script>document.location.href='bord.php';</script>";

?>

As I understand from my little knowledge and search there are deprecated in php 5.3.x

The symptom is that with the correct user and password it will not login, it doesn't redirect properly.

If anyone could land a hand it will be much appreciated.

Thank you!

Answer 1

Your JavaScript redirect is wrong. You have document.location it should be window.location. $_REQUEST is not depreciated, but you do have to make sure you are using it correctly. If your form is being submitted, make sure you test for your submit button being set. Really your code should look more like this, if you are using the $_POST method, which is more secure:

<?php
session_start();
if(isset($_POST['submitButton']) && isset($_COOKIE['ok']) && $_COOKIE['ok'] === '1'){
  setcookie('user', $_POST['name_theuser']);
  setcookie('tipe', $_POST['thetipe']);
  //send a header or do your thing here
}
else{
  header('LOCATION:disconnect.php'); die();
}
?>

I was also unclear why you were trying to do a redirect, no matter what, at the bottom of your page.

Side Note:

You do not have to use window.location.href =. You can actually just use window.location = as a shortcut. Shorter yet, you can actually just use location =, because window is implicit.

Answer 2

setcookie and $_REQUEST are not deprecated. Check: http://php.net/manual/en/migration53.deprecated.php

Depending on your server configuration $_REQUEST may not be available, which is probably what is going on here. This is also the preferred configuration because $_REQUEST is perceived to be bad.

$_REQUEST is the combined input of $_GET and $_POST. The fix is to replace it with the correct one.

If you're coming from a form with action="post" your input is in $_POST. If you're coming in on a url like mysite/login.php?name_theuser=john&thetipe=foo then you'll find your input in $_GET.