manual/en/features.cookies.php

ARCHIVED 2013-12-19, DATE APPROXIMATE · VERSION 20131219_rev01 · COMPARED WITH 20131115_rev01

Full text changes — 20131115_rev01 to 20131219_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

+Change language:
+PHP transparently supports HTTP cookies. Cookies are a mechanism for storing data in the remote browser and thus tracking or identifying return users. You can set cookies using the [setcookie()](http://www.php.net/manual/en/function.setcookie.php) or [setrawcookie()](http://www.php.net/manual/en/function.setrawcookie.php) function. Cookies are part of the HTTP header, so [setcookie()](http://www.php.net/manual/en/function.setcookie.php) must be called before any output is sent to the browser. This is the same limitation that [header()](http://www.php.net/manual/en/function.header.php) has. You can use the [output buffering functions](http://www.php.net/manual/en/ref.outcontrol.php) to delay the script output until you have decided whether or not to set any cookies or send any headers.
+Any cookies sent to you from the client will automatically be included into a [$\_COOKIE](http://www.php.net/manual/en/reserved.variables.cookies.php) auto-global array if [variables\_order](http://www.php.net/manual/en/ini.core.php) contains "C". If you wish to assign multiple values to a single cookie, just add _\[\]_ to the cookie name.
+Depending on [register\_globals](http://www.php.net/manual/en/ini.core.php), regular PHP variables can be created from cookies. However it's not recommended to rely on them as this feature is often turned off for the sake of security. $HTTP\_COOKIE\_VARS is also set in earlier versions of PHP when the [track\_vars](http://www.php.net/manual/en/ini.core.php) configuration variable is set. (This setting is always on since PHP 4.0.3.)
+For more details, including notes on browser bugs, see the [setcookie()](http://www.php.net/manual/en/function.setcookie.php) and [setrawcookie()](http://www.php.net/manual/en/function.setrawcookie.php) function.
 [**_ingen at stocken.ws_**](http://www.php.net/manual/en/features.cookies.php) [¶](http://www.php.net/manual/en/features.cookies.php)
+**6 years ago**
+**7 years ago**
 `If you want a secured session not tied to the client IP you can use the valid-for-one-query method below, but to safeguard against a scenario where the legitimate user clicks twice, you can use a shutdown function (register_shutdown_function)*.`
 `It will check to see if the script terminated prematurely (connection_aborted), and reset the valid session ID. That way, it's still valid when the user makes the second request. If the script ends properly, the new session ID will be used instead.`
 `Now, since you can't set a cookie from the shutdown function (after output has been sent), the cookie should contain both the previous valid session ID and the new one. Then the server script will determine (on the next request) which one to use.`
 `* You could use session_set_save_handler and make sure the session ID is generated in the open function. I haven't done that so I can't make any comments on it yet.`
 [**_Anonymous_**](http://www.php.net/manual/en/features.cookies.php) [¶](http://www.php.net/manual/en/features.cookies.php)
+**6 months ago**
+**7 months ago**
 `Your note is too short. Trying to test the notes system? Save us the trouble of deleting your test, and don't. It works.`
+[**_meetyashah at gmail dot com_**](http://www.php.net/manual/en/features.cookies.php) [¶](http://www.php.net/manual/en/features.cookies.php)
+**6 months ago**
+`PAGE 1`
+`<?php echo $_COOKIE["first"]; ?> PAGE 2`
+`<?php if(isset($_COOKIE["first"])) { echo $_COOKIE["first"];} echo '<br />'; if(isset($_COOKIE["second"])){ echo $_COOKIE["second"]; } echo '<br />'; if(isset($_COOKIE["third"])){ echo $_COOKIE["third"]; } ?>`
 [**_mega-squall at caramail dot com_**](http://www.php.net/manual/en/features.cookies.php) [¶](http://www.php.net/manual/en/features.cookies.php)
 **8 years ago**
 `I found a solution for protecting session ID without tying them to client's IP. Each session ID gives access for only ONE querry. On the next querry, another session ID is generated and stored. If somebody hacks the cookie (or the session ID), the first one of the user and the pirate that will use the cookie will get the second disconnected, because the session ID has been used.`
 `If the user gets disconnected, he will reconnect : as my policy is not to have more than one session ID for each user (sessions entries have a UNIQUE key on the collomn in which is stored user login), every entries for that user gets wiped, a new session ID is generated and stored on users dirve : the pirate gets disconnected. This lets the pirate usually just a few seconds to act. The slower visitors are browsing, the longer is the time pirates get for hacking. Also, if users forget to explicitly end their sessions .... some of my users set timeout longer than 20 minutes !`
 `IMPORTANT NOTE : This disables the ability of using the back button if you send the session ID via POST or GET.`
 [**_myfirstname at braincell dot cx_**](http://www.php.net/manual/en/features.cookies.php) [¶](http://www.php.net/manual/en/features.cookies.php)
 **10 years ago**
 `[Editor's note: Wilson's comment has been deleted since it didn't contain much useful information, but this note is preserved although its reference is lost]`
 `Just a general comment on Wilton's code snippet: It's generally considered very bad practice to store usernames and/or passwords in cookies, whether or not they're obsfucated. Many spyware programs make a point of stealing cookie contents.`
 `A much better solution would be to either use the PHP built in session handler or create something similar using your own cookie-based session ID. This session ID could be tied to the source IP address or can be timed out as required but since the ID can be expired separately from the authentication criteria the authentication itself is not compromised.`
 `Stuart Livings`
+\-1
+[**_meetyashah at gmail dot com_**](http://www.php.net/manual/en/features.cookies.php) [¶](http://www.php.net/manual/en/features.cookies.php)
+**7 months ago**
+`PAGE 1`
+`<?php echo $_COOKIE["first"]; ?> PAGE 2`
+`<?php if(isset($_COOKIE["first"])) { echo $_COOKIE["first"];} echo '<br />'; if(isset($_COOKIE["second"])){ echo $_COOKIE["second"]; } echo '<br />'; if(isset($_COOKIE["third"])){ echo $_COOKIE["third"]; } ?>`
+\-2
 [**_Henry_**](http://www.php.net/manual/en/features.cookies.php) [¶](http://www.php.net/manual/en/features.cookies.php)
 **4 years ago**
 `It is better to note not to attach your cookies to and IP and block the IP if it is different as some people use Portable Browsers which will remember the cookies. It is better to show a login screen instead if the IP does not correspond to the session cookie's IP.`