Question

I have this code in login.php

if ( $sth->execute() ) {
    $row = $sth->fetch(PDO::FETCH_ASSOC);
    if ( $row ) {
        var_dump($row); // See below
        $_SESSION['login'] = $row['login'];
        setcookie('login', $row['login'], time() * 7 * 24 * 60 * 60);
        if ( $row['right'] == ACCESS_ADMIN ) {
            echo "true"; // true
            $_SESSION['right'] = ACCESS_ADMIN;
            setcookie('right', $row['login'], time() * 7 * 24 * 60 * 60);
        }
    }
}


var_dump($row) - array(3) 
{ 
    ["login"]=> string(6) "phplox"
    ["password"]=> string(32) "827ccb0eea8a706c4c34a16891f84e7b"
    ["right"]=> string(5) "admin" 
} ?>
<br>

Ok, all right. Go to index.php.

<?php var_dump($_COOKIE) ?> `// array(1) { ["PHPSESSID"]=> string(26) "o05mr9luc2ok8ieadss4v9mhg0" }`

But if

<?php var_dump($_SESSION) ?> // 

the result is:

array(3) 
{
    ["request_token"]=> string(32) "335f1dcd4283889f0f2fe602cfa36d71"
    ["login"]=> string(6) "phplox" ["right"]=> string(5) "admin" 
}

Answer 1

You can’t send any output before setting cookies. Cookies are sent via a HTTP header and so they must be sent before any output has been sent to the browser. Here, you echo something, then try to set the cookie:

            echo "true"; // <--- REMOVE THIS
            $_SESSION['right'] = ACCESS_ADMIN;
            setcookie('right', $row['login'], time() + (7 * 24 * 60 * 60)); // add to the time, don't multiply time()

You can also check the return value of setcookie(), which returns a boolean false if output has already been sent.