mirror of
https://github.com/sigmasternchen/php-doc-en
synced 2025-03-15 16:38:54 +00:00
0272dc9ba7
git-svn-id: https://svn.php.net/repository/phpdoc/en/trunk@348895 c90b9560-bf6c-de11-be94-00142212c4b1
429 lines
15 KiB
XML
429 lines
15 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!-- $Revision$ -->
|
|
<refentry xml:id="function.setcookie" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
|
|
<refnamediv>
|
|
<refname>setcookie</refname>
|
|
<refpurpose>Send a cookie</refpurpose>
|
|
</refnamediv>
|
|
|
|
<refsect1 role="description">
|
|
&reftitle.description;
|
|
<methodsynopsis role="procedural">
|
|
<type>bool</type><methodname>setcookie</methodname>
|
|
<methodparam><type>string</type><parameter>name</parameter></methodparam>
|
|
<methodparam choice="opt"><type>string</type><parameter>value</parameter><initializer>""</initializer></methodparam>
|
|
<methodparam choice="opt"><type>int</type><parameter>expires</parameter><initializer>0</initializer></methodparam>
|
|
<methodparam choice="opt"><type>string</type><parameter>path</parameter><initializer>""</initializer></methodparam>
|
|
<methodparam choice="opt"><type>string</type><parameter>domain</parameter><initializer>""</initializer></methodparam>
|
|
<methodparam choice="opt"><type>bool</type><parameter>secure</parameter><initializer>&false;</initializer></methodparam>
|
|
<methodparam choice="opt"><type>bool</type><parameter>httponly</parameter><initializer>&false;</initializer></methodparam>
|
|
</methodsynopsis>
|
|
<methodsynopsis role="procedural">
|
|
<type>bool</type><methodname>setcookie</methodname>
|
|
<methodparam><type>string</type><parameter>name</parameter></methodparam>
|
|
<methodparam choice="opt"><type>string</type><parameter>value</parameter><initializer>""</initializer></methodparam>
|
|
<methodparam choice="opt"><type>array</type><parameter>options</parameter><initializer>[]</initializer></methodparam>
|
|
</methodsynopsis>
|
|
<para>
|
|
<function>setcookie</function> defines a cookie to be sent along with the
|
|
rest of the HTTP headers. Like other headers, cookies must be sent
|
|
<emphasis>before</emphasis> any output from your script (this is a
|
|
protocol restriction). This requires that you place calls to this function
|
|
prior to any output, including <literal><html></literal> and
|
|
<literal><head></literal> tags as well as any whitespace.
|
|
</para>
|
|
<para>
|
|
Once the cookies have been set, they can be accessed on the next page load
|
|
with the <varname>$_COOKIE</varname> array.
|
|
Cookie
|
|
values may also exist in <varname>$_REQUEST</varname>.
|
|
</para>
|
|
</refsect1>
|
|
|
|
<refsect1 role="parameters">
|
|
&reftitle.parameters;
|
|
<para>
|
|
<link xlink:href="&url.rfc;6265">RFC 6265</link> provides the normative
|
|
reference on how each <function>setcookie</function> parameter is
|
|
interpreted.
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><parameter>name</parameter></term>
|
|
<listitem>
|
|
<para>
|
|
The name of the cookie.
|
|
</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term><parameter>value</parameter></term>
|
|
<listitem>
|
|
<para>
|
|
The value of the cookie. This value is stored on the clients computer;
|
|
do not store sensitive information. Assuming the
|
|
<parameter>name</parameter> is <literal>'cookiename'</literal>, this
|
|
value is retrieved through <varname>$_COOKIE['cookiename']</varname>
|
|
</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term><parameter>expires</parameter></term>
|
|
<listitem>
|
|
<para>
|
|
The time the cookie expires. This is a Unix timestamp so is
|
|
in number of seconds since the epoch. In other words, you'll
|
|
most likely set this with the <function>time</function> function
|
|
plus the number of seconds before you want it to expire. Or
|
|
you might use <function>mktime</function>.
|
|
<literal>time()+60*60*24*30</literal> will set the cookie to
|
|
expire in 30 days. If set to 0, or omitted, the cookie will expire at
|
|
the end of the session (when the browser closes).
|
|
</para>
|
|
<para>
|
|
<note>
|
|
<para>
|
|
You may notice the <parameter>expires</parameter> parameter takes on a
|
|
Unix timestamp, as opposed to the date format <literal>Wdy, DD-Mon-YYYY
|
|
HH:MM:SS GMT</literal>, this is because PHP does this conversion
|
|
internally.
|
|
</para>
|
|
</note>
|
|
</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term><parameter>path</parameter></term>
|
|
<listitem>
|
|
<para>
|
|
The path on the server in which the cookie will be available on.
|
|
If set to <literal>'/'</literal>, the cookie will be available
|
|
within the entire <parameter>domain</parameter>. If set to
|
|
<literal>'/foo/'</literal>, the cookie will only be available
|
|
within the <literal>/foo/</literal> directory and all
|
|
sub-directories such as <literal>/foo/bar/</literal> of
|
|
<parameter>domain</parameter>. The default value is the
|
|
current directory that the cookie is being set in.
|
|
</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term><parameter>domain</parameter></term>
|
|
<listitem>
|
|
<para>
|
|
The (sub)domain that the cookie is available to. Setting this to a
|
|
subdomain (such as <literal>'www.example.com'</literal>) will make the
|
|
cookie available to that subdomain and all other sub-domains of it (i.e.
|
|
w2.www.example.com). To make the cookie available to the whole domain
|
|
(including all subdomains of it), simply set the value to the domain
|
|
name (<literal>'example.com'</literal>, in this case).
|
|
</para>
|
|
<para>
|
|
Older browsers still implementing the deprecated
|
|
<link xlink:href="&url.rfc;2109">RFC 2109</link> may require a leading
|
|
<literal>.</literal> to match all subdomains.
|
|
</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term><parameter>secure</parameter></term>
|
|
<listitem>
|
|
<para>
|
|
Indicates that the cookie should only be transmitted over a
|
|
secure HTTPS connection from the client. When set to &true;, the
|
|
cookie will only be set if a secure connection exists.
|
|
On the server-side, it's on the programmer to send this
|
|
kind of cookie only on secure connection (e.g. with respect to
|
|
<varname>$_SERVER["HTTPS"]</varname>).
|
|
</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term><parameter>httponly</parameter></term>
|
|
<listitem>
|
|
<para>
|
|
When &true; the cookie will be made accessible only through the HTTP
|
|
protocol. This means that the cookie won't be accessible by
|
|
scripting languages, such as JavaScript. It has been suggested that
|
|
this setting can effectively help to reduce identity theft through
|
|
XSS attacks (although it is not supported by all browsers), but that
|
|
claim is often disputed. Added in PHP 5.2.0.
|
|
&true; or &false;
|
|
</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term><parameter>options</parameter></term>
|
|
<listitem>
|
|
<para>
|
|
An associative <type>array</type> which may have any of the keys
|
|
<literal>expires</literal>, <literal>path</literal>, <literal>domain</literal>,
|
|
<literal>secure</literal>, <literal>httponly</literal> and <literal>samesite</literal>.
|
|
The values have the same meaning as described for the parameters with the
|
|
same name. The value of the <literal>samesite</literal> element should be
|
|
either <literal>None</literal>, <literal>Lax</literal> or <literal>Strict</literal>.
|
|
If any of the allowed options are not given, their default values are the
|
|
same as the default values of the explicit parameters. If the
|
|
<literal>samesite</literal> element is omitted, no SameSite cookie
|
|
attribute is set.
|
|
</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</para>
|
|
</refsect1>
|
|
|
|
<refsect1 role="returnvalues">
|
|
&reftitle.returnvalues;
|
|
<para>
|
|
If output exists prior to calling this function,
|
|
<function>setcookie</function> will fail and return &false;. If
|
|
<function>setcookie</function> successfully runs, it will return &true;.
|
|
This does not indicate whether the user accepted the cookie.
|
|
</para>
|
|
</refsect1>
|
|
|
|
<refsect1 role="examples">
|
|
&reftitle.examples;
|
|
<para>
|
|
Some examples follow how to send cookies:
|
|
<example>
|
|
<title><function>setcookie</function> send example</title>
|
|
<programlisting role="php">
|
|
<![CDATA[
|
|
<?php
|
|
$value = 'something from somewhere';
|
|
|
|
setcookie("TestCookie", $value);
|
|
setcookie("TestCookie", $value, time()+3600); /* expire in 1 hour */
|
|
setcookie("TestCookie", $value, time()+3600, "/~rasmus/", "example.com", 1);
|
|
?>
|
|
]]>
|
|
</programlisting>
|
|
</example>
|
|
</para>
|
|
<para>
|
|
Note that the value portion of the cookie will automatically be
|
|
urlencoded when you send the cookie, and when it is received, it
|
|
is automatically decoded and assigned to a variable by the same
|
|
name as the cookie name. If you don't want this, you can use
|
|
<function>setrawcookie</function> instead if you are using PHP 5. To see
|
|
the contents of our test cookie in a script, simply use one of the
|
|
following examples:
|
|
</para>
|
|
<para>
|
|
<informalexample>
|
|
<programlisting role="php">
|
|
<![CDATA[
|
|
<?php
|
|
// Print an individual cookie
|
|
echo $_COOKIE["TestCookie"];
|
|
|
|
// Another way to debug/test is to view all cookies
|
|
print_r($_COOKIE);
|
|
?>
|
|
]]>
|
|
</programlisting>
|
|
</informalexample>
|
|
</para>
|
|
<para>
|
|
<example>
|
|
<title><function>setcookie</function> delete example</title>
|
|
<para>
|
|
When deleting a cookie you should assure that the expiration date
|
|
is in the past, to trigger the removal mechanism in your browser.
|
|
Examples follow how to delete cookies sent in previous example:
|
|
</para>
|
|
<programlisting role="php">
|
|
<![CDATA[
|
|
<?php
|
|
// set the expiration date to one hour ago
|
|
setcookie("TestCookie", "", time() - 3600);
|
|
setcookie("TestCookie", "", time() - 3600, "/~rasmus/", "example.com", 1);
|
|
?>
|
|
]]>
|
|
</programlisting>
|
|
</example>
|
|
</para>
|
|
<para>
|
|
<example>
|
|
<title><function>setcookie</function> and arrays</title>
|
|
<para>
|
|
You may also set array cookies by using array notation in the
|
|
cookie name. This has the effect of setting as many cookies as
|
|
you have array elements, but when the cookie is received by your
|
|
script, the values are all placed in an array with the cookie's
|
|
name:
|
|
</para>
|
|
<programlisting role="php">
|
|
<![CDATA[
|
|
<?php
|
|
// set the cookies
|
|
setcookie("cookie[three]", "cookiethree");
|
|
setcookie("cookie[two]", "cookietwo");
|
|
setcookie("cookie[one]", "cookieone");
|
|
|
|
// after the page reloads, print them out
|
|
if (isset($_COOKIE['cookie'])) {
|
|
foreach ($_COOKIE['cookie'] as $name => $value) {
|
|
$name = htmlspecialchars($name);
|
|
$value = htmlspecialchars($value);
|
|
echo "$name : $value <br />\n";
|
|
}
|
|
}
|
|
?>
|
|
]]>
|
|
</programlisting>
|
|
&example.outputs;
|
|
<screen>
|
|
<![CDATA[
|
|
three : cookiethree
|
|
two : cookietwo
|
|
one : cookieone
|
|
]]>
|
|
</screen>
|
|
</example>
|
|
</para>
|
|
</refsect1>
|
|
|
|
<refsect1 role="changelog">
|
|
&reftitle.changelog;
|
|
<para>
|
|
<informaltable>
|
|
<tgroup cols="2">
|
|
<thead>
|
|
<row>
|
|
<entry>&Version;</entry>
|
|
<entry>&Description;</entry>
|
|
</row>
|
|
</thead>
|
|
<tbody>
|
|
<row>
|
|
<entry>7.3.0</entry>
|
|
<entry>
|
|
An alternative signature supporting an <parameter>options</parameter>
|
|
array has been added. This signature supports also setting of the
|
|
SameSite cookie attribute.
|
|
</entry>
|
|
</row>
|
|
<row>
|
|
<entry>5.5.0</entry>
|
|
<entry>
|
|
A Max-Age attribute is now included in the Set-Cookie header sent to
|
|
the client.
|
|
</entry>
|
|
</row>
|
|
<row>
|
|
<entry>5.2.0</entry>
|
|
<entry>
|
|
The <parameter>httponly</parameter> parameter was added.
|
|
</entry>
|
|
</row>
|
|
</tbody>
|
|
</tgroup>
|
|
</informaltable>
|
|
</para>
|
|
</refsect1>
|
|
|
|
<refsect1 role="notes">
|
|
&reftitle.notes;
|
|
<note>
|
|
<para>
|
|
You can use output buffering to send output prior to the
|
|
call of this function, with the overhead of all of your output to the
|
|
browser being buffered in the server until you send it. You can do this
|
|
by calling <function>ob_start</function> and
|
|
<function>ob_end_flush</function> in your script, or setting the
|
|
<literal>output_buffering</literal> configuration directive on in your
|
|
&php.ini; or server configuration files.
|
|
</para>
|
|
</note>
|
|
<note>
|
|
<para>
|
|
If the PHP directive <link linkend="ini.register-globals">register_globals</link>
|
|
is set to <literal>on</literal> then cookie values will also be made into
|
|
variables. In our examples below, <varname>$TestCookie</varname> will
|
|
exist. It's recommended to use <varname>$_COOKIE</varname>.
|
|
</para>
|
|
</note>
|
|
<para>
|
|
Common Pitfalls:
|
|
<itemizedlist>
|
|
<listitem>
|
|
<simpara>
|
|
Cookies will not become visible until the next loading of a page that
|
|
the cookie should be visible for. To test if a cookie was successfully
|
|
set, check for the cookie on a next loading page before the cookie
|
|
expires. Expire time is set via the <parameter>expires</parameter>
|
|
parameter. A nice way to debug the existence of cookies is by
|
|
simply calling <literal>print_r($_COOKIE);</literal>.
|
|
</simpara>
|
|
</listitem>
|
|
<listitem>
|
|
<simpara>
|
|
Cookies must be deleted with the same parameters as they were set with.
|
|
If the value argument is an empty string, or &false;, and all other arguments
|
|
match a previous call to setcookie, then the cookie with the specified
|
|
name will be deleted from the remote client.
|
|
This is internally achieved by setting value to 'deleted' and expiration
|
|
time to one year in past.
|
|
</simpara>
|
|
</listitem>
|
|
<listitem>
|
|
<simpara>
|
|
Because setting a cookie with a value of &false; will try to delete the cookie,
|
|
you should not use boolean values. Instead, use <emphasis>0</emphasis> for &false;
|
|
and <emphasis>1</emphasis> for &true;.
|
|
</simpara>
|
|
</listitem>
|
|
<listitem>
|
|
<simpara>
|
|
Cookies names can be set as array names and will be available to your
|
|
PHP scripts as arrays but separate cookies are stored on the user's
|
|
system. Consider <function>explode</function> to set one cookie with
|
|
multiple names and values. It is not recommended to use
|
|
<function>serialize</function> for this purpose, because it can result
|
|
in security holes.
|
|
</simpara>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</para>
|
|
<simpara>
|
|
Multiple calls to <function>setcookie</function> are performed in the order called.
|
|
</simpara>
|
|
</refsect1>
|
|
|
|
<refsect1 role="seealso">
|
|
&reftitle.seealso;
|
|
<para>
|
|
<simplelist>
|
|
<member><function>header</function></member>
|
|
<member><function>setrawcookie</function></member>
|
|
<member><link linkend="features.cookies">cookies section</link></member>
|
|
<member><link xlink:href="&url.rfc;6265">RFC 6265</link></member>
|
|
<member><link xlink:href="&url.rfc;2109">RFC 2109</link></member>
|
|
</simplelist>
|
|
</para>
|
|
</refsect1>
|
|
|
|
</refentry>
|
|
|
|
<!-- Keep this comment at the end of the file
|
|
Local variables:
|
|
mode: sgml
|
|
sgml-omittag:t
|
|
sgml-shorttag:t
|
|
sgml-minimize-attributes:nil
|
|
sgml-always-quote-attributes:t
|
|
sgml-indent-step:1
|
|
sgml-indent-data:t
|
|
indent-tabs-mode:nil
|
|
sgml-parent-document:nil
|
|
sgml-default-dtd-file:"~/.phpdoc/manual.ced"
|
|
sgml-exposed-tags:nil
|
|
sgml-local-catalogs:nil
|
|
sgml-local-ecat-files:nil
|
|
End:
|
|
vim600: syn=xml fen fdm=syntax fdl=2 si
|
|
vim: et tw=78 syn=sgml
|
|
vi: ts=1 sw=1
|
|
-->
|