manual/en/features.cookies.php
20040604_rev01 · COMPARED WITH 20030805_rev01 · ARCHIVE SNAPSHOT, DATE APPROXIMATE
Full text changes — 20030805_rev01 to 20040604_rev01
| 1 | ## Chapter 17. Cookies | |
| 1 | `[Editor's note: Wilson's comment has been deleted since it didn't contain much useful information, but this note is preserved although its reference is lost]` | |
| 2 | 2 | |
| 3 | PHP transparently supports HTTP cookies. Cookies are a mechanism for storing data in the remote browser and thus tracking or identifying return users. You can set cookies using the [**setcookie()**](http://www.php.net/manual/en/function.setcookie.php) function. Cookies are part of the HTTP header, so [**setcookie()**](http://www.php.net/manual/en/function.setcookie.php) must be called before any output is sent to the browser. This is the same limitation that [**header()**](http://www.php.net/manual/en/function.header.php) has. You can use the [output buffering functions](http://www.php.net/manual/en/ref.outcontrol.php) to delay the script output until you have decided whether or not to set any cookies or send any headers. | |
| 3 | `Just a general comment on Wilton's code snippet: It's generally considered very bad practice to store usernames and/or passwords in cookies, whether or not they're obsfucated. Many spyware programs make a point of stealing cookie contents.` | |
| 4 | 4 | |
| 5 | Any cookies sent to you from the client will automatically be turned into a PHP variable just like GET and POST method data, depending on the register\_globals and variables\_order configuration variables. If you wish to assign multiple values to a single cookie, just add _\[\]_ to the cookie name. | |
| 5 | `A much better solution would be to either use the PHP built in session handler or create something similar using your own cookie-based session ID. This session ID could be tied to the source IP address or can be timed out as required but since the ID can be expired separately from the authentication criteria the authentication itself is not compromised.` | |
| 6 | 6 | |
| 7 | In PHP 4.1.0 and later, the $\_COOKIE auto-global array will always be set with any cookies sent from the client. $HTTP\_COOKIE\_VARS is also set in earlier versions of PHP when the track\_vars configuration variable is set. | |
| 8 | ||
| 9 | For more details, including notes on browser bugs, see the [**setcookie()**](http://www.php.net/manual/en/function.setcookie.php) function. | |
| 10 | ||
| 11 | <table><tbody><tr><td><small>User Contributed Notes</small><br><b>Cookies</b></td><td><a href="http://www.php.net/manual/add-note.php?sect=features.cookies&redirect=http://www.php.net/manual/en/features.cookies.php"><img src="http://static.php.net/www.php.net/images/notes-add.gif" alt="add a note" width="13" height="13"></a> <small><a href="http://www.php.net/manual/add-note.php?sect=features.cookies&redirect=http://www.php.net/manual/en/features.cookies.php">add a note</a></small></td></tr><tr><td colspan="2"><a name="#34157"></a><table><tbody><tr><td><b>wilton at intertranet dot com</b><br>17-Jul-2003 05:14</td><td><br></td></tr><tr><td colspan="2"><code>if ((isset($aid)) && (isset($pwd)) && ($op == "login")) {<br> if($aid!="" AND $pwd!="") {<br>$pwd = md5($pwd);<br>$result=sql_query("select pwd, admlanguage from ".$prefix."_authors where aid='$aid'", $dbi);<br>list($pass, $admlanguage)=sql_fetch_row($result, $dbi);<br>if($pass == $pwd) {<br> $admin = base64_encode("$aid:$pwd:$admlanguage");<br> setcookie("admin","$admin",time()+3600);<br> unset($op);<br>}<br> }<br>}<p>$admintest = 0;</p><p>if(isset($admin) && $admin != "") {<br>$admin = base64_decode($admin);<br> $admin = explode(":", $admin);<br> $aid = "$admin[0]";<br> $pwd = "$admin[1]";<br> $admlanguage = "$admin[2]";<br> if ($aid=="" || $pwd=="") {<br> $admintest=0;<br> echo "<html>\n";<br> echo "<title>Ingreso prohibido</title>\n";<br> echo "<body bgcolor=\"#FFFFFF\" text=\"#000000\">\n\n</p><p>\n\n";<br> echo "<center><img src=\"images/logo.gif\" border=\"0\"></p><p>\n";<br> echo "<font face=\"Verdana\" size=\"+4\"><b>Su Ip esta siendo registrada en nuestra base de datos, toda operaci�n indebida ser� investigada.</p><p>Gerencia Administrativa</b></font></center>\n";<br> echo "</body>\n";<br> echo "</html>\n";</p></code><br></td></tr></tbody></table></td></tr><tr><td colspan="2"><a href="http://www.php.net/manual/add-note.php?sect=features.cookies&redirect=http://www.php.net/manual/en/features.cookies.php"><img src="http://static.php.net/www.php.net/images/notes-add.gif" alt="add a note" width="13" height="13"></a> <small><a href="http://www.php.net/manual/add-note.php?sect=features.cookies&redirect=http://www.php.net/manual/en/features.cookies.php">add a note</a></small></td></tr></tbody></table> | |
| 7 | `Stuart Livings` |