PHP manual/en/features.cookies.php changes — 20170101_rev01

3

Any cookies sent to you from the client will automatically be included into a [$\_COOKIE](http://php.net/manual/en/reserved.variables.cookies.php) auto-global array if [variables\_order](http://php.net/manual/en/ini.core.php) contains "C". If you wish to assign multiple values to a single cookie, just add _\[\]_ to the cookie name.

4

5

Depending on [register\_globals](http://php.net/manual/en/ini.core.php), regular PHP variables can be created from cookies. However it's not recommended to rely on them as this feature is often turned off for the sake of security.

6

7

For more details, including notes on browser bugs, see the [setcookie()](http://php.net/manual/en/function.setcookie.php) and [setrawcookie()](http://php.net/manual/en/function.setrawcookie.php) function.

8

9

117

9

121

10

11

[**_Tugrul_**](http://php.net/manual/en/features.cookies.php) [¶](http://php.net/manual/en/features.cookies.php)

12

13

**1 year ago**

14

15

`Setting new cookie ============================= <?php setcookie("name","value",time()+$int); /*name is your cookie's name value is cookie's value $int is time of cookie expires*/ ?> Getting Cookie ============================= <?php echo $_COOKIE["your cookie name"]; ?> Updating Cookie ============================= <?php setcookie("color","red"); echo $_COOKIE["color"]; /*color is red*/ /* your codes and functions*/ setcookie("color","blue"); echo $_COOKIE["color"]; /*new color is blue*/ ?> Deleting Cookie ============================== <?php unset($_COOKIE["yourcookie"]); /*Or*/ setcookie("yourcookie","yourvalue",time()-1); /*it expired so it's deleted*/ ?> Reference: [http://gencbilgin.net/php-cookie-kullanimi.html](http://gencbilgin.net/php-cookie-kullanimi.html)`

16

17

13

17

12

18

19

[**_myfirstname at braincell dot cx_**](http://php.net/manual/en/features.cookies.php) [¶](http://php.net/manual/en/features.cookies.php)

20

21

**13 years ago**

22

23

`[Editor's note: Wilson's comment has been deleted since it didn't contain much useful information, but this note is preserved although its reference is lost]`

 Any cookies sent to you from the client will automatically be included into a [$\_COOKIE](http://php.net/manual/en/reserved.variables.cookies.php) auto-global array if [variables\_order](http://php.net/manual/en/ini.core.php) contains "C". If you wish to assign multiple values to a single cookie, just add _\[\]_ to the cookie name.
 Depending on [register\_globals](http://php.net/manual/en/ini.core.php), regular PHP variables can be created from cookies. However it's not recommended to rely on them as this feature is often turned off for the sake of security.
 For more details, including notes on browser bugs, see the [setcookie()](http://php.net/manual/en/function.setcookie.php) and [setrawcookie()](http://php.net/manual/en/function.setrawcookie.php) function.
 [**_Tugrul_**](http://php.net/manual/en/features.cookies.php) [¶](http://php.net/manual/en/features.cookies.php)
 **1 year ago**
 `Setting new cookie ============================= <?php setcookie("name","value",time()+$int); /*name is your cookie's name value is cookie's value $int is time of cookie expires*/ ?> Getting Cookie ============================= <?php echo $_COOKIE["your cookie name"]; ?> Updating Cookie ============================= <?php setcookie("color","red"); echo $_COOKIE["color"]; /*color is red*/ /* your codes and functions*/ setcookie("color","blue"); echo $_COOKIE["color"]; /*new color is blue*/ ?> Deleting Cookie ============================== <?php unset($_COOKIE["yourcookie"]); /*Or*/ setcookie("yourcookie","yourvalue",time()-1); /*it expired so it's deleted*/ ?> Reference: [http://gencbilgin.net/php-cookie-kullanimi.html](http://gencbilgin.net/php-cookie-kullanimi.html)`
 [**_myfirstname at braincell dot cx_**](http://php.net/manual/en/features.cookies.php) [¶](http://php.net/manual/en/features.cookies.php)
 **13 years ago**
 `[Editor's note: Wilson's comment has been deleted since it didn't contain much useful information, but this note is preserved although its reference is lost]`
 `Stuart Livings`
 \-19
 [**_ingen at stocken.ws_**](http://php.net/manual/en/features.cookies.php) [¶](http://php.net/manual/en/features.cookies.php)
+**9 years ago**
+**10 years ago**
 `If you want a secured session not tied to the client IP you can use the valid-for-one-query method below, but to safeguard against a scenario where the legitimate user clicks twice, you can use a shutdown function (register_shutdown_function)*.`
 `It will check to see if the script terminated prematurely (connection_aborted), and reset the valid session ID. That way, it's still valid when the user makes the second request. If the script ends properly, the new session ID will be used instead.`
 `Now, since you can't set a cookie from the shutdown function (after output has been sent), the cookie should contain both the previous valid session ID and the new one. Then the server script will determine (on the next request) which one to use.`
 `A- Users double click on links or make 2 clicks very fast. The same key is sent for the 2 clicks because the new key from the first click didn't get to the browser on time for the second one but the session on the server did trash the key for the new one. Thus, the second click causes a termination of the session. (install the LiveHttpHeaders extension on firefox and look at the headers sent when you click twice very fast, you'll see the same cookie sent on both and the new cookie getting back from the server too late).`
 `B- For any given reason, the server experiences a slow down and the response with the new key (which has replaced the old one on the server) is not returned to the browser fast enough. The user gets tired of waiting and clicks somewhere else. He gets logged out because this second click send the old key which won't match the one you have on your server.`
 `Our solution was to set up a grace period where the old key was still valid (the current key and the previous key were both kept at all times, we used 15 seconds as a grace period where the old key could still be used). This has the drawback of increasing the window of time for a person to highjack the session but if you tie the validity of the old key to an IP address and/or user agent string, you still get pretty good session security with very very few undesired session termination.`
+\-38
+[**_Anonymous_**](http://php.net/manual/en/features.cookies.php) [¶](http://php.net/manual/en/features.cookies.php)
+**3 years ago**
+`Your note is too short. Trying to test the notes system? Save us the trouble of deleting your test, and don't. It works.`
 \-42
 [**_kalla\_durga at gmail dot com_**](http://php.net/manual/en/features.cookies.php) [¶](http://php.net/manual/en/features.cookies.php)
 **10 years ago**
 `A- Users double click on links or make 2 clicks very fast. The same key is sent for the 2 clicks because the new key from the first click didn't get to the browser on time for the second one but the session on the server did trash the key for the new one. Thus, the second click causes a termination of the session. (install the LiveHttpHeaders extension on firefox and look at the headers sent when you click twice very fast, you'll see the same cookie sent on both and the new cookie getting back from the server too late).`
 `B- For any given reason, the server experiences a slow down and the response with the new key (which has replaced the old one on the server) is not returned to the browser fast enough. The user gets tired of waiting and clicks somewhere else. He gets logged out because this second click send the old key which won't match the one you have on your server.`
 `Our solution was to set up a grace period where the old key was still valid (the current key and the previous key were both kept at all times, we used 15 seconds as a grace period where the old key could still be used). This has the drawback of increasing the window of time for a person to highjack the session but if you tie the validity of the old key to an IP address and/or user agent string, you still get pretty good session security with very very few undesired session termination.`
+\-41
+\-42
 [**_mega-squall at caramail dot com_**](http://php.net/manual/en/features.cookies.php) [¶](http://php.net/manual/en/features.cookies.php)
 **11 years ago**
 `I found a solution for protecting session ID without tying them to client's IP. Each session ID gives access for only ONE querry. On the next querry, another session ID is generated and stored. If somebody hacks the cookie (or the session ID), the first one of the user and the pirate that will use the cookie will get the second disconnected, because the session ID has been used.`

manual/en/features.cookies.php

Full text changes — 20161107_rev01 to 20170101_rev01