Tayyab Bin Tariq » Web Development

Writing Unified Scalable Application Logic: Windows Workflow Foundation

tayyabtariq — Sat, 23 May 2009 19:55:31 +0000

Everyone who writes applications or creates software wants to create scalable and easy to understand solutions. The problem however is that simple software is not scalable and scalable applications can get too hard to understand because of their distributed logic development.

A simple application may be implemented as shown in the following figure.

Figure 1: Simple unified logic that runs in a single process and thread (Courtesy MSDN).

The above pseudo-code takes input from the client and based on the input executed different paths. Note that the input is taken at different points in the code. The state of the application/process is represented here by a simple string. Although this application development style is simple and easy to understand, it is not scalable. Imagine you are using such application logic for a hiring process where the inputs can come after days and even weeks. Your server would have to keep the process alive and running for this whole period. Imagine how much resources it would take to cater for thousands of users. What if the server fails during this period?

Considering these problems, lets look at another solution. This time round we separate the application logic at the freezing points (the input). Breaking the application logic allows the application to run as two different threads. This can solve a few of the problems described above.

Figure 2: Breaking the application logic (Courtesy MSDN).

Note that this time round the state is stored outside of the process in a database. The reason is that whenever the second process starts it needs to get the current state from some “persistent” store. Also note that the two application parts can now run on two different machines. Can you see a problem with this? The problem comes from the fact that it is hard for the second process to know whether the if was executed in the first part or the else (of course you would have to make this a part of the state). The point here is that the state becomes complex and we have to introduce a number of checks in the second part of the application.

The first figure is how our usual desktop applications run. they have their state stored in some memory variables that vanish as soon as the application ends. The applications which remember what you did last time have to save this state in some persistent storage. The second example is how ASP.NET applications work. The application logic is implemented in a distributed manner (on different pages). This not only makes it difficult for people to understand the process but also the programmer has to perform a series of checks whenever a page loads. It is also to be noted that the first type provides us unified logic whereas the second provides us scalability.

The Solution

Using windows workflows can help us solve these problems. WF function just as a normal program providing mechanism for input, output, control flow etc. However, all these are done with the help of activities, see diagram below.

Figure 3: In a workflow all the things are done with the help of activities (Courtesy MSDN)

As you can probably already see that unified logic is provided by workflows, let us see how WF solve the problem of scalability. All the work in the WF is done using activates, and as seen the WF provides all the elements of a usual programming language. The difference however is that all these activities are classes themselves, and they are executed on a WF Runtime which knows how to run these classes (activities).

Figure 3: WF Runtime executes activities in order (Courtesy MSDN).

When it begins the workflow runtime executes the outer most activity first, which in this case is a sequential workflow. Then it executes the activities one after the other in order determined by the workflow. One thing to note here is that the activities are objects, and therefore can be described in any language, making the workflow independent of the language. Also that the WF Runtime does not know anything about the internals of the activity it is executing, allow the programmer to fill in what is to be done. WF provides a Base Activity Library (BAL) from which you can pick activities to include in your workflow. You can also create activates of your own, called custom activities.

The big question arises, why go through all this pain? The first answer to this question has already been answered, it provides unified logic. However, to be scalable the server application cannot be stuck with one process. One solution to this is the ASP.NET way, i.a. to break the application logic down into small chunks, however this is something we are trying to avoid. Moreover, the programmer than has to explicitly deal with state. As you can probably notice this WF is already broken down into chunks, this allows the WF to persist (not block waiting for an event). When at the start of our example workflow, the workflow is waiting for input the WF Runtime realizes this and stores the state of the WF in a persistent storage (we say the WF persists). This allows for the server resources to be used elsewhere. When the input arrives the WF Runtime wakes up the WF.

Figure 5: The workflow can persist (Courtesy MSDN).

Another advantage of the workflow being broken down from the perspective of scalability is the ability of the WF to be run on different machines when it resumes, as shown in the following diagram.

Figure 6 Different parts of a workflow can run on different machines

Other Benefits

Other benefits of using windows workflows include the following

Coordinating Parallel Work

The WF allows you to coordinate parallel work in a better way by using the parallel activity which is part of BAL (More on this in later articles).

Figure 7 Workflows can run parallel activates (Courtesy MSDN).

Providing Tracking

Tracking processes is an important part of any business application. WF makes it extremely easy to do this by providing tracking services. The tracking services are extremely closely linked to persistence (state maintenance) because the state of the WF has all the information one needs for tracking a WF.

Figure 8 You can track the WF using tracking services (Courtesy MSDN).

Creating custom activities

WF allows you to create custom activities that you can re use as is suited to your business application, allowing to use OO concepts in WF.

Figure 9 You can create custom activities (Courtesy MSDN).

Fully Declarative Language

WFs are fully declarative as each workflow is represented by a corresponding XAML file.

Figure 10 WFs are fully declarative (Courtesy MSDN).

http://msdn.microsoft.com/en-us/library/dd851337.aspx

Share on Facebook

Form Based Authentication in ASP.NET

tayyabtariq — Thu, 30 Apr 2009 11:39:07 +0000

This article demonstrates how to implement forms-based authentication by using a database to store the users.

Create an ASP.NET Application Using C# .NET

Open Visual Studio .NET.
Create a new ASP.NET Web application, and specify the name and location.

Configure the Security Settings in the Web.config File

This section demonstrates how to add and modify the and configuration sections to configure the ASP.NET application to use forms-based authentication.

In Solution Explorer, open the Web.config file.
Change the authentication mode to Forms.
Insert the tag, and fill the appropriate attributes. Copy the following code, and then click Paste as HTML on the Edit menu to paste the code in the section of the file:

<authentication mode="Forms">
   <forms name=".ASPXFORMSDEMO" loginUrl="logon.aspx" 
   protection="All" path="/" timeout="30" />
authentication> 
    

Deny access to the anonymous user in the section as follows:

<authorization>
   <deny users ="?" />
   <allow users = "*" />
authorization>

Create a Logon.aspx Page

Add a new Web Form to the project named Logon.aspx.
Open the Logon.aspx page in the editor, and switch to HTML view.
Copy the following code, and use the Paste as HTML option on the Edit menu to insert the code between the
tags:

<h3>
   <font face="Verdana">Logon Pagefont>
h3>
<table>
   <tr>
      <td>Email:td>
      <td><input id="txtUserName" type="text" runat="server">td>
      <td><ASP:RequiredFieldValidator ControlToValidate="txtUserName"
           Display="Static" ErrorMessage="*" runat="server" 
           ID="vUserName" />td>
   tr>
   <tr>
      <td>Password:td>
      <td><input id="txtUserPass" type="password" runat="server">td>
      <td><ASP:RequiredFieldValidator ControlToValidate="txtUserPass"
          Display="Static" ErrorMessage="*" runat="server" 
          ID="vUserPass" />
      td>
   tr>
   <tr>
      <td>Persistent Cookie:td>
      <td><ASP:CheckBox id="chkPersistCookie" runat="server" autopostback="false" />td>
      <td>td>
   tr>
table>
<input type="submit" Value="Logon" runat="server" ID="cmdLogin"><p>p>
<asp:Label id="lblMsg" ForeColor="red" Font-Name="Verdana" Font-Size="10" runat="server" />
                        

This Web Form is used to present a logon form to users so that they can provide their user name and password to log on to the application.
Switch to Design view, and save the page.

Code the Event Handler So That It Validates the User Credentials

This section presents the code that is placed in the code-behind page (Logon.aspx.cs).

Double-click Logon to open the Logon.aspx.cs file.
Import the required namespaces in the code-behind file:

   1: using System.Data.SqlClient;
   2: using System.Web.Security;

Create a ValidateUser function to validate the user credentials by looking in the database. (Make sure that you change the Connection string to point to your database).

private bool ValidateUser( string userName, string passWord )
{
    SqlConnection conn;
    SqlCommand cmd;
    string lookupPassword = null;
  
    // Check for invalid userName.
    // userName must not be null and must be between 1 and 15 characters.
    if ( (  null == userName ) || ( 0 == userName.Length ) || ( userName.Length > 15 ) )
    {
        System.Diagnostics.Trace.WriteLine( "[ValidateUser] Input validation of userName failed." );
        return false;
    }
  
    // Check for invalid passWord.
    // passWord must not be null and must be between 1 and 25 characters.
    if ( (  null == passWord ) || ( 0 == passWord.Length ) || ( passWord.Length > 25 ) )
    {
        System.Diagnostics.Trace.WriteLine( "[ValidateUser] Input validation of passWord failed." );
        return false;
    }
  
    try
    {
        // Consult with your SQL Server administrator for an appropriate connection
        // string to use to connect to your local SQL Server.
        conn = new SqlConnection( "server=localhost;Integrated Security=SSPI;database=pubs" );
        conn.Open();
  
        // Create SqlCommand to select pwd field from users table given supplied userName.
        cmd = new SqlCommand( "Select pwd from users where uname=@userName", conn );
        cmd.Parameters.Add( "@userName", SqlDbType.VarChar, 25 );
        cmd.Parameters["@userName"].Value = userName;
  
        // Execute command and fetch pwd field into lookupPassword string.
        lookupPassword = (string) cmd.ExecuteScalar();
  
        // Cleanup command and connection objects.
        cmd.Dispose();
        conn.Dispose();
    }
    catch ( Exception ex )
    {
        // Add error handling here for debugging.
        // This error message should not be sent back to the caller.
        System.Diagnostics.Trace.WriteLine( "[ValidateUser] Exception " + ex.Message );
    }
  
    // If no password found, return false.
    if ( null == lookupPassword ) 
    {
        // You could write failed login attempts here to event log for additional security.
        return false;
    }
  
    // Compare lookupPassword and input passWord, using a case-sensitive comparison.
    return ( 0 == string.Compare( lookupPassword, passWord, false ) );
  
}

You can use one of two methods to generate the forms authentication cookie and redirect the user to an appropriate page in the cmdLogin_ServerClick event. Sample code is provided for both scenarios. Use either of them according to your requirement.

Call the RedirectFromLoginPage method to automatically generate the forms authentication cookie and redirect the user to an appropriate page in the cmdLogin_ServerClick event:

private void cmdLogin_ServerClick(object sender, System.EventArgs e)
{
if (ValidateUser(txtUserName.Value,txtUserPass.Value) )
    FormsAuthentication.RedirectFromLoginPage(txtUserName.Value,
        chkPersistCookie.Checked);
    else
        Response.Redirect("logon.aspx", true);
}

Generate the authentication ticket, encrypt it, create a cookie, add it to the response, and redirect the user. This gives you more control in how you create the cookie. You can also include custom data along with the FormsAuthenticationTicket in this case.

private void cmdLogin_ServerClick(object sender, System.EventArgs e)
{
   if (ValidateUser(txtUserName.Value,txtUserPass.Value) )
   {
      FormsAuthenticationTicket tkt;
      string cookiestr;
      HttpCookie ck;
      tkt = new FormsAuthenticationTicket(1, txtUserName.Value, DateTime.Now, 
DateTime.Now.AddMinutes(30), chkPersistCookie.Checked, "your custom data");
      cookiestr = FormsAuthentication.Encrypt(tkt);
      ck = new HttpCookie(FormsAuthentication.FormsCookieName, cookiestr);
      if (chkPersistCookie.Checked)
      ck.Expires=tkt.Expiration;    
            ck.Path = FormsAuthentication.FormsCookiePath; 
      Response.Cookies.Add(ck);
  
      string strRedirect;
      strRedirect = Request["ReturnUrl"];
      if (strRedirect==null)
            strRedirect = "default.aspx";
         Response.Redirect(strRedirect, true);
   }
   else
      Response.Redirect("logon.aspx", true);
}

Make sure that the following code is added to the InitializeComponent method in the code that the Web Form Designer generates:

   1: this.cmdLogin.ServerClick += new System.EventHandler(this.cmdLogin_ServerClick);

Create a Default.aspx Page

This section creates a test page to which users are redirected after they authenticate. If users browse to this page without first logging on to the application, they are redirected to the logon page.

Rename the existing WebForm1.aspx page as Default.aspx, and open it in the editor.
Switch to HTML view, and copy the following code between the tags:

   1: <input type="submit" Value="SignOut" runat="server" id="cmdSignOut">

This button is used to log off the forms authentication session.
Switch to Design view, and save the page.
Import the required namespaces in the code-behind file:

   1: using System.Web.Security;

Double-click SignOut to open the code-behind page (Default.aspx.cs), and copy the following code in the cmdSignOut_ServerClick event handler:

private void cmdSignOut_ServerClick(object sender, System.EventArgs e)
{
   FormsAuthentication.SignOut();
   Response.Redirect("logon.aspx", true);
}

Make sure that the following code is added to the InitializeComponent method in the code that the Web Form Designer generates:

   1: this.cmdSignOut.ServerClick += new System.EventHandler(this.cmdSignOut_ServerClick);

Save and compile the project. You can now use the application.

Share on Facebook

Creating Simple Member Login Area Using PHP

tayyabtariq — Tue, 31 Mar 2009 15:54:59 +0000

This tutorial is aimed at creating a simple login/members area using PHP MySQL.

I will waste no time and get straight down to business. The tutorial is based on 6 easy steps.

Step 1:

Creating a table in the database.

I have created a very simple table that has only two columns; username and password.

Here is the SQL:

CREATE TABLE `userstable` (
`userName` varchar(20) NOT NULL default ”,
`password` varchar(20) NOT NULL default ”,
PRIMARY KEY (`userName`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

Step 2:

Create a connection to the database. Although the file below is meant only for a database connection I have taken the liberty of using it to save some general purpose settings as well.

//dbConfig.php

/*

The config file for the database connection and variables

change the database name and username and password

/

//variables for the databse connection
$serverName = “localhost”;
$userName = “manager”;
$password = “”;
$dbName = “testdatabase”;

$conn = mysql_pconnect($serverName, $userName, $password);
if (!$conn)
{
//print error message, the echo command support html encodeing.
echo(’The connection to the database could not be established!’);
die(’The connection to the database could not be established!’);
}
else
{
// select the database which you wish to opereate
mysql_select_db($dbName);

}

// other variable
$loginSuccess = “phpMembersArea.php”;
$RegisterSuccess = “phpRegister.php?op=thanks”;
$loginRequired = “phpLogin.php?op=loginFirst”;
$timeout = 3600;
$authenticatioMethod = “cookie”;

function CheckLogin() {

// fucntion that checks if some is logged in or not
global $authenticatioMethod;
if (strcmp($authenticatioMethod ,”cookie”) == 0)//we have choosen to use cookies
{

if (!isset($_COOKIE["login"]))
{
return null;
}
else
{
return $_COOKIE["login"];

}
}
else// we are using session based authentication
{
if (!$_Session["userID"] || $_Session["valid_expire_time"] < time())
{
$_Session["userID"] = null;
$_Session["valid_expire_time"] = time()-1;
session_destroy();
return null;
}
else
{
return $_Session["userID"];
}
}
return null;
}
function RedirectTo($url)
{
//I have to use this function because the php function header can only be called
// if no output has been sent
// this solution uses java scripts so beware
echo(’’);
}
?>

Step 3:

Create a Registeration Page.

I provide a simple registeration page, where you can enter two fields, username and password.

//phpRegister.php

Username:

Password:

// first we include the dbconfig file
// note that we do not need to open the connection
// when the file is included and this page is loaded, the code is automatically executed
echo(’hello’);
include (”dbConfig.php”);

/*

Here is the plan of action, this is the page that contains the registeration form

also this is the page that will connect to the database and execute the insert query

so we need to know if the page is being run from a

/

// we suppose that a variable named op would be passed with a value
// register if there is a registeration request.
if ($_GET["op"] == “register”)
{

if (!($userID = $_POST["userID"]) )
{
echo(’UserName field is missing!’);
}
else if (!($password = $_POST["password"]))
{
echo(’Password field is missing!’);
}

$query = “INSERT INTO `USERSTABLE` VALUES( ‘”.$_POST["userID"].”‘, Password(’”.$_POST["password"].”‘))”;
//note that my sql requires the password filed to be casted
// also note that . is the string concatenation operator
// also not the “ around the table name

$result = mysql_query($query, $conn);
//you can also redirect to a different page

if (!$result )
{
// make sure that the user was inserted
echo(’
The user could not be inserted
’);
echo(’The error cant be displayed
’);
}
else
{

REdirectTo($RegisterSuccess);
}

}
else if ($_GET["op"] == “thanks”)
{
echo(’
The user was added successfully!
’);
}
//The web form for input ability

?>

After this step you have successfully created a user account. All you need to do now is to create a login page.

Step 4:

The plan of action for our login page is that we pass it an query string argument, ‘op’ that dictates what the page does. If the value of this variable is ‘login’ the page gets the POST information and tries to login.

//phpLogin.php

include (’dbConfig.php’);
if ($_GET["op"] == “login”)//check if this is a login request
{
$query = “Select * from `userstable` where `userName`=’”.$_POST["userID"].”‘ AND `password`=Password(’”.$_POST["password"].”‘) “;

$result = mysql_query($query, $conn);
$obj = @mysql_fetch_object($result);
if ($obj)
{
// means sucessful login
$loginSucessful = 1;
//create session variables
// i will create both a login cookie
// and session variables
// and show how to use both for authentication

$_SESSION["valid_userID"] = $_POST["userID"];
$_SESSION["valide_time"] = time();
$_SESSION["valid_expire_time"] = time()+$timeout;

//set the cookies
//i create a cookie where i set the cookie information to the user name
// the userID can be encrypted also for better security.
setcookie(”login”, $_POST["userID"], time()+$timeout);

// create a cookie
}
else
{
$loginSucessful = 0;
}

if ($loginSucessful == 1)
{
//login has succeeded proceed to members area
if ($_GET["referrer"] )
{
// if we were sent to the login page due to some request of a members area page
// go to that page
RedirectTo($_POST["referrer"]);
}
else
{
RedirectTo($loginSuccess);
}
}
else
{
echo(’
Login Information is not correct
’.$_POST["userID"].’ does not exist or password is incorrect
’);
}
}
else if($_GET["op"] == “loginFirst”)
{
echo(’
You must login first.
’);
}
?>

”); ?>

UserID:

Password:

Caution: There must be nothing before the ‘

PS: When a members area page is accessed without being logged in, the page redirects to the login page giving it a ‘referrer’ argument. I however could not make it work, if anyone can help please look at:

”); ?>

I was trying to replace this with

”); ?>

However, whenever there was a valid referrer the username and password is not verified, the page works fine otherwise.

Step 5:

The members area page.

//phpMembersArea.php

session_start();
include (’dbConfig.php’);
$loggedInUser = CheckLogin();
if (!$loggedInUser)// no one is logged in
{
echo(’You are not logged in’);
RedirectTo(”phpLogin.php?referrer=phpMembersArea.php”);
}
else
{
echo(’
Welcome ‘.$loggedInUser.’!

’);
}
?>

This is the members area

Logout

?>

The page calls the CheckLogin() function defined in the dbConfig.php. This function checks the cookie or the session variable for login information. If this information is found the login proceeds otherwise the user is redirected to the login page.

Step 6:

The logout page simply deletes the cookie and the session.

//phpLogout.php

setcookie(”login”, “”, time()-100);
include (’DbConfig.php’);

RedirectTo(”index.php”);
?>
To change this template, choose Tools | Templates
and open the template in the editor.
–>

And there you go, you are done.

Share on Facebook

Login Sessions: Cookies vs Session Variable

tayyabtariq — Tue, 31 Mar 2009 18:07:31 +0000

Cookies and Session variables are two ways, implementation members areas and user login/security. The two methods are a bargain between server performance and security. Server side security gives better security but is just not practical for larger number of users and can seriously deteriorate server performance. On the other hand user side security is far more efficient and lighter on the server however is far more susceptible to security breaches.

Although I assume a basic knowledge of what cookies and sessions are, we start with a quick review.

“HTTP cookies, more commonly referred to as Web cookies, tracking cookies or just cookies, are parcels of text sent by a server to a Web client browser) and then sent back unchanged by client each time it accesses that server. HTTP cookies are used for authenticating, session tracking (state maintenance), and maintaining specific information about users, such as site preferences or the contents of their electronic shopping carts. The term “cookie” is derived from “magic cookie,” a well-known concept in UNIX computing which inspired both the idea and the name of HTTP cookies. Some alternatives to cookies exist, but each has its own uses, advantages, and drawbacks.” (usually a

– Wikipedia (http://en.wikipedia.org/wiki/HTTP_cookie)

“In computer science, in particular networking, a session is a semi-permanent interactive information exchange, also known as a dialogue, a conversation or a meeting, between two or more communicating devices, or between a computer and user (see Login session). A session is set up or established at a certain point in time, and torn down at a later point in time. An established communication session may involve more than one message in each direction. A session is typically, but not always, stateful, meaning that at least one of the communicating parts needs to save information about the session history in order to be able to communicate, as opposed to stateless communication, where the communication consists of independent requests with responses.

…

HTTP sessions, which may allow dynamic web pages, i.e. interactive web pages, as opposed to static web pages.”

–Wikipedia (http://en.wikipedia.org/wiki/Session_(computer_science))

“Server side web sessions

Server-side sessions are handy and efficient, but can become difficult to handle in conjunction with load-balancing/high-availability systems and are not usable at all in embedded systems with no storage. The load-balancing problem can be solved by using shared storage or by applying forced peering between each client and a single server in the cluster, although this can compromise system efficiency and load distribution.

A method of using server-side sessions in systems without mass-storage is to reserve a portion of RAM for storage of session data. This method is applicable for servers with a limited number of clients (e.g. router or access point with infrequent or disallowed access to more than one client at a time).

In the two scenarios above, using client-side sessions could provide advantages over server-side sessions: in the first case by removing the limitations applied to load-balancing algorithms (which usually translates to load distribution optimisation), and in the second case by allowing the use of sessions in web applications when server disk space or RAM is not available or sufficient for this storage.”

–Wikipedia (http://en.wikipedia.org/wiki/Session_(computer_science))

Now that we have enough insight into what server side and user side security and session maintenance means, we can get down to the business of comparing the two. As it is evident up to here that the server side security (web sessions) are far more secure. There is no information that can be changed by the user, unless of course your server is hacked but then “…you have a bigger fish to fry…”, log in sessions would be the leasat of your worries. The drawback however is that the server must maintain all the information of the sessions, that too in the RAM. This can be a considerable over head for the server, not to mention can degrade performance to a great extent and may even cause the server to run out of memory. On the other hand if the session variables are to be maintained jointly on the user system and the server, this over head is avoided. The problem however is that ’smart’ users can control what cookies they send, thereby compromising security. Forging cookies is the most common way the user accounts are hacked. I sill remember the enormous number of articles on the internet regarding hacking hotmail account using cookies till hotmail solved the problem*.

Cookie based security is the most widely used these days and seems to be the clear ‘practical’ winner in the face off. However, it clearly is less secure. So I put up these questions as some food for thought.

Since the main problem with server side security is that of memory use over head. What if web languages like PHP, C# etc provide a way to store the session information on permanent storage and implement a simple ‘cache’ like system to keep only the recently used information in the RAM (Though I would suggest that the recently used information be dicarded to permanent storage if needed). This would make the server a little slower but would surely be far more secure.

PS: * How did hotmail solve the problem?

Share on Facebook

Tayyab Bin Tariq » Web Development

Writing Unified Scalable Application Logic: Windows Workflow Foundation

The Solution

Other Benefits

Coordinating Parallel Work

Providing Tracking

Creating custom activities

Fully Declarative Language

Related articles

Form Based Authentication in ASP.NET

Create an ASP.NET Application Using C# .NET

Configure the Security Settings in the Web.config File

Create a Logon.aspx Page

Code the Event Handler So That It Validates the User Credentials

Create a Default.aspx Page

Creating Simple Member Login Area Using PHP

The user could not be inserted
’);
echo(’The error cant be displayed

The user was added successfully!

Login Information is not correct
’.$_POST["userID"].’ does not exist or password is incorrect

You must login first.

Welcome ‘.$loggedInUser.’!

This is the members area

Login Sessions: Cookies vs Session Variable

Tayyab Bin Tariq » Web Development

Writing Unified Scalable Application Logic: Windows Workflow Foundation

The Solution

Other Benefits

Coordinating Parallel Work

Providing Tracking

Creating custom activities

Fully Declarative Language

Related articles

Form Based Authentication in ASP.NET

Create an ASP.NET Application Using C# .NET

Configure the Security Settings in the Web.config File

Create a Logon.aspx Page

Code the Event Handler So That It Validates the User Credentials

Create a Default.aspx Page

Creating Simple Member Login Area Using PHP

The user could not be inserted’); echo(’The error cant be displayed

The user was added successfully!

Login Information is not correct’.$_POST["userID"].’ does not exist or password is incorrect

You must login first.

Welcome ‘.$loggedInUser.’!

This is the members area

Login Sessions: Cookies vs Session Variable

The user could not be inserted
’);
echo(’The error cant be displayed

Login Information is not correct
’.$_POST["userID"].’ does not exist or password is incorrect