Setting and Viewing Cookies with PHP

Addition: Cookies should be set with the "secure" flag whenever a cookie is set from a web page with a secure connection (https:// vs. http://). The "https://www.willmaster.com/library/web-development/setting-secure-cookies.php library article talks about how to set a secure cookie with JavaScript and with PHP.

Here is a fun way to learn about cookies by setting them and then viewing them.

See also Setting and Reading Cookies with JavaScript .

First, let's set a cookie.

In a PHP web page, put these 14 lines of PHP code at the top of the web page source code. There may be no characters, no spaces, and no blank lines in the file above this PHP code:

<?php
$Name = "mycookie";       // Specify the cookie's name.
$Value = "hello, there";  // Specify the cookie's value.
$Directory = "/";         // Specify the valid directory.
$DaysCookieShallLast = 1; // Specify number of days.
$domain = $_SERVER{"SERVER_NAME"};
$domain = "." . preg_replace("/^www\./","",$domain);
$Directory = preg_replace("/\/+$/","",$Directory);
$Directory = preg_replace("/^\/+/","",$Directory);
$Directory = "/$Directory";
$lasting = time() + ($DaysCookieShallLast * 24 * 60 * 60);
if($DaysCookieShallLast < 1) { $lasting = ""; }
setcookie($Name,$Value,$lasting,$Directory,$domain);
?>

In the above code, you may change:

• The cookie's name. Cookies must have a name. It can be any sequence of characters excluding semi-colon, comma and white space.

• The cookie's value. The value may be empty or contain any sequence of characters. There is a limit to how many characters the value may contain. The entire cookie, cookie name, domain name, value, etc., may be no more than 4k in size. So the maximum size of the value by itself would be some less than 4k.

• The valid directory. This is the directory (and its subdirectories) that the cookie may be read from. "/" represents the document root, a cookie that can be read from anywhere on the domain. "/books" would mean the cookie can only be read from directory /books and its subdirectories.

• The number of days the cookie shall live. Specify 0 for a session cookie (a cookie that deletes when the browser is closed). Otherwise, specify the number of days.

The setcookie() function is the line that sets the cookie. The other code lines prepare the variables for the function.

If you are familiar with PHP, you may wish to put values directly into the function call and the variables dispensed with. It would give you more control over exactly what values are sent to the setcookie() function. For example, the cookie lifetime doesn't have to be in days, but can be specified in shorter blocks -- hours or even seconds. And additional parameters may be sent to the function, such as an indication that the cookie may be set and read only with a secure connection.

The above paragraph is only for those having good familiarity with PHP. For everybody else, simply pop the PHP code into the web page, as is, or with some of the variables changed.

Upload the web page with the cookie setting PHP code to your server and load the page into your browser. When the page loads into the browser, the cookie is set.

Note: When a cookie is set with PHP, the cookie will be available to the browser at the next page load, not the same page load as when the cookie was set. This is unlike JavaScript, where the cookie is available immediately.

OK, now let's view the cookie.

These 5 lines of PHP code put anywhere within the body area of a PHP web page will tell you what cookies the browser has available:

<?php
echo('<pre>');
print_r($_COOKIE);
echo('</pre>');
?>

Upload the page to your server and load the page into your browser. It will list any cookies available for the directory where the page is located.

The list of cookies is rather raw. But the information is there. Code could be written to pretty the cookie display.

The cookies specification can be studied for a deeper understanding. The specification is no longer at Netscape (which developed the specification). However, you can find a copy at https://curl.haxx.se/rfc/cookie_spec.html

Will Bontrager