manual/en/features.cookies.php
20010617_rev01 · COMPARED WITH 20010416_rev01 · ARCHIVE SNAPSHOT, DATE APPROXIMATE
Full text changes — 20010416_rev01 to 20010617_rev01
| 1 | 1 | ## Chapter 18. Cookies |
| 2 | 2 | |
| 3 | 3 | PHP transparently supports HTTP cookies. Cookies are a mechanism for storing data in the remote browser and thus tracking or identifying return users. You can set cookies using the [**setcookie()**](https://php.net/manual/en/function.setcookie.php) function. Cookies are part of the HTTP header, so [**setcookie()**](https://php.net/manual/en/function.setcookie.php) must be called before any output is sent to the browser. This is the same limitation that [**header()**](https://php.net/manual/en/function.header.php) has. |
| 4 | 4 | |
| 5 | 5 | Any cookies sent to you from the client will automatically be turned into a PHP variable just like GET and POST method data. If you wish to assign multiple values to a single cookie, just add _\[\]_ to the cookie name. For more details see the [**setcookie()**](https://php.net/manual/en/function.setcookie.php) function. |
| 6 | 6 | |
| 7 | <table><tbody><tr><td><b>User Contributed Notes: Cookies</b></td></tr><tr><td><table><tbody><tr><td><a href="mailto:mallsop@ihets.org">mallsop@ihets.org</a><br>29-Sep-1999 01:53</td></tr><tr><td><tt>Taken from mod_auth_radius.c (see http://www.apache.org):<p>Some browsers (I.E.) have a problem with sending cookies on initial<br>requests. If you have a file index.html which includes img/foo.gif<br>in the same directory. The user authenticates, reads index.html<br>(with the cookie in the request header), BUT on reading the gifs,<br>the cookie is NOT included.</p><p>This problem can be avoided by EITHER putting the gifs in the same<br>directory as the index.html file, or putting moving the entire tree<br>down a node, and having a NEW index.html which points to ./moved/index.html<br>This is ridiculously ugly, but it seems to work.</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:no_junk_mail@digital-concepts.net">no_junk_mail@digital-concepts.net</a><br>29-Jan-2000 04:03</td></tr><tr><td><tt>You can expire(delete) a previously set cookie by resetting the same cookie with a date that is expired..i.e. 01/01/99</tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:geo@rambler.ru">geo@rambler.ru</a><br>03-Aug-2000 01:15</td></tr><tr><td><tt>It seems, that setting more then 20 cookies makes cookies, that were sent earlier, to expire</tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:tomas@lobbyist.nu">tomas@lobbyist.nu</a><br>05-Aug-2000 10:46</td></tr><tr><td><tt>The cookie specs declare that one url can't set more than 20 cookies.</tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:builder9@hotmail.com">builder9@hotmail.com</a><br>14-Sep-2000 08:34</td></tr><tr><td><tt>[Editor's note: You can set a cookie *value* to be an array of values if you do need to send a lot of data (see also: serialize, unserialize), this is different than sending an array of cookies]<p>I read in the PHP bible that you can treat cookies as arrays by using a pointer suffix ie [#]. This does not appear to remedy the 20 cookie limit.<br>- Moses</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:IrfanButt@bigfoot.com">IrfanButt@bigfoot.com</a><br>25-Sep-2000 04:22</td></tr><tr><td><tt>Beware! If you set an expiry time on a cookie and the time at the client is not synchronized with that of the server, the cookie expires immediately on receipt at the client! This has caused more than one person to tear their hair out!</tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:jeanluc.richter@iname.com">jeanluc.richter@iname.com</a><br>09-Oct-2000 08:59</td></tr><tr><td><tt>I insist on the time checking for cookies : if there's no cookie in the cookie folder of your browser, check the time of the client and that of the server:<br>If you give an expire date at Time + 3600 seconds and your server is one hour late (problem with summer/winter time), the cookie will NEVER be written on the client!!<br>As a previous comment said, I have lost a lot of hair on that thing ;)</tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:xn@bnw.com">xn@bnw.com</a><br>23-Oct-2000 02:29</td></tr><tr><td><tt>the following browser is broken:<br>Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt)<p>when you delete a cookie from this browser, it sets the cookie value to the string "deleted" and sends that back.</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:bigal@hotmail.com">bigal@hotmail.com</a><br>14-Nov-2000 12:44</td></tr><tr><td><tt>Newbies! Here's a working 'setcookie' - &lt;?<br>setcookie ("TestCookie[]" , "Test Value" , time()+864000);<br>?><p>It will be added to your 'cookies' folder! No expiration date set means no cookie y'all!</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:nohow@contrariwise.com">nohow@contrariwise.com</a><br>26-Nov-2000 09:05</td></tr><tr><td><tt>Actually, if you don't set an expire time the cookie WILL be set -- but only for the current session. When this is the case, the cookie is not added to your cookies file or temp internet folder; it's stored in memory, and when all browser windows are closed, it disappears.<p>Newbies, indeed.</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:marcel@databasenews.com">marcel@databasenews.com</a><br>05-Dec-2000 09:29</td></tr><tr><td><tt>For those of you who "REALLY" want to display data or information before setting a cookie:<p>Try using the output control functions at : http://www.php.net/manual/ref.outcontrol.php</p><p>Using those functions you can actually send information a browser before setting a cookie or sending a header.</p><p>so, according to the manual, this should work:</p><p>&lt;?php</p><p>ob_start();<br>echo "Hello\n";</p><p>setcookie ("cookiename", "cookiedata");</p><p>ob_end_flush();</p><p>?></p><p>go ahead, try it...</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:martin@kouba.at">martin@kouba.at</a><br>02-Feb-2001 12:34</td></tr><tr><td><tt>just as seoman@geocities.com stated on an other page:<br>setcookie() behaves a bit strange when you set cookies from different directories. when you set a cookie from a subdirectory you won't see it from a page in the parent directory! use the header directive instead.</tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:martin@kouba.at">martin@kouba.at</a><br>02-Feb-2001 12:49</td></tr><tr><td><tt>to set cookies from a subdirectory and access it from a page in the parent directory use the path-parameter:<p>setcookie("name", "value", "", "path")</p><p>to make a session cookie that will expire when the browser is closed leave the third param an empty string.</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:dwatson@nospam.abwam.com">dwatson@nospam.abwam.com</a><br>08-Mar-2001 03:36</td></tr><tr><td><tt>I discovered that if you are going to setcookie(), make sure your <?php ?> code is the first line of your script, and the first character. Even new lines and spaces mess with setting cookies.</tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:yasuo_ohgaki@hotmail.com">yasuo_ohgaki@hotmail.com</a><br>09-Mar-2001 08:58</td></tr><tr><td><tt>It might be good idea that manual mentions related standard (RFC2965,RFC2109 for cookie, Netscape's cookie spec also) and URL for the standard.<p>Following link is for cookie definitions:<br>http://portal.research.bell-labs.com/~dmk/cookie.html</p><p>It seems many users do not read standard definitions, unfortunately. Manual may need to be written to encourage users to read related standards.</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:plutoalien@gmx.net">plutoalien@gmx.net</a><br>29-Mar-2001 09:18</td></tr><tr><td><tt>It doesn't work with IE 6.00.2462.0000. No cookies will be saved.</tt><br></td></tr></tbody></table></td></tr></tbody></table> | |
| 7 | <table><tbody><tr><td><b>User Contributed Notes: Cookies</b></td></tr><tr><td><table><tbody><tr><td><a href="mailto:mallsop@ihets.org">mallsop@ihets.org</a><br>29-Sep-1999 01:53</td></tr><tr><td><tt>Taken from mod_auth_radius.c (see http://www.apache.org):<p>Some browsers (I.E.) have a problem with sending cookies on initial<br>requests. If you have a file index.html which includes img/foo.gif<br>in the same directory. The user authenticates, reads index.html<br>(with the cookie in the request header), BUT on reading the gifs,<br>the cookie is NOT included.</p><p>This problem can be avoided by EITHER putting the gifs in the same<br>directory as the index.html file, or putting moving the entire tree<br>down a node, and having a NEW index.html which points to ./moved/index.html<br>This is ridiculously ugly, but it seems to work.</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:no_junk_mail@digital-concepts.net">no_junk_mail@digital-concepts.net</a><br>29-Jan-2000 04:03</td></tr><tr><td><tt>You can expire(delete) a previously set cookie by resetting the same cookie with a date that is expired..i.e. 01/01/99</tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:geo@rambler.ru">geo@rambler.ru</a><br>03-Aug-2000 01:15</td></tr><tr><td><tt>It seems, that setting more then 20 cookies makes cookies, that were sent earlier, to expire</tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:tomas@lobbyist.nu">tomas@lobbyist.nu</a><br>05-Aug-2000 10:46</td></tr><tr><td><tt>The cookie specs declare that one url can't set more than 20 cookies.</tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:builder9@hotmail.com">builder9@hotmail.com</a><br>14-Sep-2000 08:34</td></tr><tr><td><tt>[Editor's note: You can set a cookie *value* to be an array of values if you do need to send a lot of data (see also: serialize, unserialize), this is different than sending an array of cookies]<p>I read in the PHP bible that you can treat cookies as arrays by using a pointer suffix ie [#]. This does not appear to remedy the 20 cookie limit.<br>- Moses</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:IrfanButt@bigfoot.com">IrfanButt@bigfoot.com</a><br>25-Sep-2000 04:22</td></tr><tr><td><tt>Beware! If you set an expiry time on a cookie and the time at the client is not synchronized with that of the server, the cookie expires immediately on receipt at the client! This has caused more than one person to tear their hair out!</tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:jeanluc.richter@iname.com">jeanluc.richter@iname.com</a><br>09-Oct-2000 08:59</td></tr><tr><td><tt>I insist on the time checking for cookies : if there's no cookie in the cookie folder of your browser, check the time of the client and that of the server:<br>If you give an expire date at Time + 3600 seconds and your server is one hour late (problem with summer/winter time), the cookie will NEVER be written on the client!!<br>As a previous comment said, I have lost a lot of hair on that thing ;)</tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:xn@bnw.com">xn@bnw.com</a><br>23-Oct-2000 02:29</td></tr><tr><td><tt>the following browser is broken:<br>Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt)<p>when you delete a cookie from this browser, it sets the cookie value to the string "deleted" and sends that back.</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:bigal@hotmail.com">bigal@hotmail.com</a><br>14-Nov-2000 12:44</td></tr><tr><td><tt>Newbies! Here's a working 'setcookie' - &lt;?<br>setcookie ("TestCookie[]" , "Test Value" , time()+864000);<br>?><p>It will be added to your 'cookies' folder! No expiration date set means no cookie y'all!</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:nohow@contrariwise.com">nohow@contrariwise.com</a><br>26-Nov-2000 09:05</td></tr><tr><td><tt>Actually, if you don't set an expire time the cookie WILL be set -- but only for the current session. When this is the case, the cookie is not added to your cookies file or temp internet folder; it's stored in memory, and when all browser windows are closed, it disappears.<p>Newbies, indeed.</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:marcel@databasenews.com">marcel@databasenews.com</a><br>05-Dec-2000 09:29</td></tr><tr><td><tt>For those of you who "REALLY" want to display data or information before setting a cookie:<p>Try using the output control functions at : http://www.php.net/manual/ref.outcontrol.php</p><p>Using those functions you can actually send information a browser before setting a cookie or sending a header.</p><p>so, according to the manual, this should work:</p><p>&lt;?php</p><p>ob_start();<br>echo "Hello\n";</p><p>setcookie ("cookiename", "cookiedata");</p><p>ob_end_flush();</p><p>?></p><p>go ahead, try it...</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:martin@kouba.at">martin@kouba.at</a><br>02-Feb-2001 12:34</td></tr><tr><td><tt>just as seoman@geocities.com stated on an other page:<br>setcookie() behaves a bit strange when you set cookies from different directories. when you set a cookie from a subdirectory you won't see it from a page in the parent directory! use the header directive instead.</tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:martin@kouba.at">martin@kouba.at</a><br>02-Feb-2001 12:49</td></tr><tr><td><tt>to set cookies from a subdirectory and access it from a page in the parent directory use the path-parameter:<p>setcookie("name", "value", "", "path")</p><p>to make a session cookie that will expire when the browser is closed leave the third param an empty string.</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:dwatson@nospam.abwam.com">dwatson@nospam.abwam.com</a><br>08-Mar-2001 03:36</td></tr><tr><td><tt>I discovered that if you are going to setcookie(), make sure your <?php ?> code is the first line of your script, and the first character. Even new lines and spaces mess with setting cookies.</tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:yasuo_ohgaki@hotmail.com">yasuo_ohgaki@hotmail.com</a><br>09-Mar-2001 08:58</td></tr><tr><td><tt>It might be good idea that manual mentions related standard (RFC2965,RFC2109 for cookie, Netscape's cookie spec also) and URL for the standard.<p>Following link is for cookie definitions:<br>http://portal.research.bell-labs.com/~dmk/cookie.html</p><p>It seems many users do not read standard definitions, unfortunately. Manual may need to be written to encourage users to read related standards.</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:plutoalien@gmx.net">plutoalien@gmx.net</a><br>29-Mar-2001 09:18</td></tr><tr><td><tt>It doesn't work with IE 6.00.2462.0000. No cookies will be saved.</tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:jasoncermak@hotmail.com">jasoncermak@hotmail.com</a><br>02-May-2001 12:53</td></tr><tr><td><tt>To suppliment the comment about refreshing the page above: If you are frustrated that the new cookie value cannot be used until the page is refreshed try to cut and paste this code:<p><?PHP</p><p>ob_start();//Allows the cookie to be run after the code.</p><p>echo "you can run whatever you want here. The cookie will be set after.";</p><p>setcookie ("session", "cookievalue");<br>echo "<br><html><br><head><br><META HTTP-EQUIV=\"Refresh\"CONTENT=\"0;URL=foo.php\"><br></head><br></html>";//Meta tag needed to refresh the cookie.</p><p>ob_end_flush();//Calles the buffered data.<br>?></p><p>The page called after the cookie is defined is foo.php. When foo.php loads, the cookie will be availible.</p><p>And there was much rejoicing.</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:baldweedie@hotmail.com">baldweedie@hotmail.com</a><br>01-Jun-2001 07:49</td></tr><tr><td><tt>You can set and retrieve a cookie with a dynamic name.<p>setcookie("product_$p", "some info", time+666, etc...);</p><p>then to retrieve..<br>$tmp = "product_$p";<br>if ($dynamic_cookie = ${$tmp}) {<br>print "found cookie $tmp = $dynamic_cookie\n";<br>}</p></tt><br></td></tr></tbody></table></td></tr><tr><td><table><tbody><tr><td><a href="mailto:Scree@scree.org">Scree@scree.org</a><br>13-Jun-2001 12:28</td></tr><tr><td><tt>Setting cookies does work with IE 6.0, the beta that i have anyways. I've succesfully got it to store session cookies, i havent had an oppourtunity to test time-delayed cookies but im assuming it should work as well?</tt><br></td></tr></tbody></table></td></tr></tbody></table> |