Почему setcookie выдает ошибку

Many people do it the complicated way:
setcookie('name', 'content', time()-3600);

But why do you make it so complicated and risk it not working, when the client's time is wrong? Why fiddle around with time();

Here's the easiest way to unset a cookie:
setcookie('name', 'content', 1);

Thats it.

<?php
$arr_cookie_options = array (
                'expires' => time() + 60*60*24*30,
                'path' => '/',
                'domain' => '.example.com', // leading dot for compatibility or use subdomain
                'secure' => true,     // or false
                'httponly' => true,    // or false
                'samesite' => 'None' // None || Lax  || Strict
                );
setcookie('TestCookie', 'The Cookie Value', $arr_cookie_options);   
?>

On high traffic sites, this can substantially increase the size of subsequent HTTP requests from clients (including requests for static content on the same domain).

More importantly though, the cookie specification says that browsers need only accept 20 cookies per domain.  This limit is increased to 50 by Firefox, and to 30 by Opera, but IE6 and IE7 enforce the limit of 20 cookie per domain.  Any cookies beyond this limit will either knock out an older cookie or be ignored/rejected by the browser.

<?php
// this will actually set 'ace_fontSize' name:
setcookie( 'ace.fontSize', 18 );
?>

<?php $_SERVER['HTTP_COOKIE'] ?>

rather than:

<?php $_COOKIE ?>

to dertermine the cookie names.
If cookie names are in Array notation, eg: user[username]
Then PHP will automatically create a corresponding array in $_COOKIE. Instead use $_SERVER['HTTP_COOKIE'] as it mirrors the actual HTTP Request header.

<?php// unset cookies
if (isset($_SERVER['HTTP_COOKIE'])) {
    $cookies = explode(';', $_SERVER['HTTP_COOKIE']);
    foreach($cookies as $cookie) {
        $parts = explode('=', $cookie);
        $name = trim($parts[0]);
        setcookie($name, '', time()-1000);
        setcookie($name, '', time()-1000, '/');
    }
}?>

to make your code work on both localhost and a proper domain, you can do this:

<?php

$domain

= ($_SERVER['HTTP_HOST'] != 'localhost') ? $_SERVER['HTTP_HOST'] : false;
setcookie('cookiename', 'data', time()+60*60*24*365, '/', $domain, false);?>

setcookie('empty_domain','value',time()+3600,'') 
equal       test.com

setcookie('test_com_domain','value',time()+3600,'','test.com')  
equal       .test.com

setcookie('dot_test_com_domain','value',time()+3600,'','.test.com') 
equal       .test.com

ps:   .test.com   has its self    and child domain

For earlier versions of PHP,  you can set the header() directly:

header('Set-Cookie: cross-site-cookie=bar; SameSite=None; Secure');

What happens is that the browser, when closes the window, if it is a well behaved browser, will delete the cookie from the cookie store.

However, the cookie will survive in the server until the garbage collector removes the session, which will happen only when it kicks in and checks the specified session is out of bounds of the setting stated in:

http://php.net/manual/en/session.configuration.php#ini.session.gc-maxlifetime

Please check also:

http://php.net/manual/en/session.security.ini.php

And in case of doubt, PHP runs on the webserver and has no way whatsoever to interact with a browser apart from receiving requests and answering with responses, so assuming that a cookie will be removed from a browser is just an "hint" for the browser. There is no warranty that such will happen as instructed.

That is one of the reasons why the cookie values sent to browsers by some platforms are encrypted and timestamped, to ensure that they are actual and not tampered.

It seems the IE (6, 7, 8 and 9) do not accept the part 'Expire=0' when setting a session cookie. To fix it just don't put any expire at all. The default behavior when the 'Expire' is not set is to set the cookie as a session one.

(Firefox doesn't complains, btw.)

<?php

//Flag up repeat actions (like credit card transaction, etc)

if(count($_POST)>0) {

    $lastpost= isset($_COOKIE['lastpost']) ? $_COOKIE['lastpost'] : '';

    if($lastpost!=md5(serialize($_POST))) {

        setcookie('lastpost', md5(serialize($_POST)));

        $_POST['_REPEATED']=0;

    } else {

        $_POST['_REPEATED']=1;

    }

}
//At this point, if $_POST['_REPEATED']==1, then  the user

//has hit the refresh button; so don't do any actions that you don't

//want to repeat!

?>



Hope that helps :)

Gareth

header("Set-Cookie: PHPSESSID=abc; path=/; domain=.sub.domain.com");
header("Set-Cookie: PHPSESSID=abc; path=/; domain=.domain.com");
print_r(headers_list()); // here you see two Set-Cookie headers with domains for PHPSESSID
session_id('abc');
session_start();
print_r(headers_list()); // here you don't; you see only one Set-Cookie produced by session_start()

In a nutshell, when setting a cookie value, I serialize it, gzcompress it, base64 encode it, break it into pieces and store it as a set of cookies.  To fetch the cookie value I get the named piece then iterate through piece names rebuilding the base64 data, then reverse the rest of the process.  The only other trick is deleting the pieces correctly.

Sessions are better, but if they are not available this is a viable alternative.  I chose gz over bz for compression because it looked faster with only slightly worse ratios.

Here is a simplified version of my implementation.  This is a good starting point but is not suitable for most uses.  For example, the domain and path are hard coded and no return values are checked for validity.

<?php

define( 'COOKIE_PORTIONS' , '_piece_' );

function

clearpieces( $inKey , $inFirst ) {

    $expire = time()-3600;

   
    for (

$index = $inFirst ; array_key_exists( $inKey.COOKIE_PORTIONS.$index , $_COOKIE ) ; $index += 1 ) {

        setcookie( $inKey.COOKIE_PORTIONS.$index , '' , $expire , '/' , '' , 0 );

        unset( $_COOKIE[$inKey.COOKIE_PORTIONS.$index] );

    }

}

function

clearcookie( $inKey ) {

    clearpieces( $inKey , 1 );

    setcookie( $inKey , '' , time()-3600 , '/' , '' , 0 );

    unset( $_COOKIE[$inKey] );

}

function

storecookie( $inKey , $inValue , $inExpire ) {

    $decode = serialize( $inValue );

    $decode = gzcompress( $decode );

    $decode = base64_encode( $decode );
$split = str_split( $decode , 4000 );//4k pieces

    $count = count( $split );

   
    for (

$index = 0 ; $index < $count ; $index += 1 ) {

        $result = setcookie( ( $index > 0 ) ? $inKey.COOKIE_PORTIONS.$index : $inKey , $split[$index] , $inExpire , '/' , '' , 0 );

    }
clearpieces( $inKey , $count );

}

function

fetchcookie( $inKey ) {

    $decode = $_COOKIE[$inKey];

   
    for (

$index = 1 ; array_key_exists( $inKey.COOKIE_PORTIONS.$index , $_COOKIE ) ; $index += 1 ) {

        $decode .= $_COOKIE[$inKey.COOKIE_PORTIONS.$index];

    }
$decode = base64_decode( $decode );

    $decode = gzuncompress( $decode );

   
    return

unserialize( $decode );

}

?>

<?php

$Seperator

= '--';
$uniqueID = 'Ju?hG&F0yh9?=/6*GVfd-d8u6f86hp';
$Data = 'Ahmet '.md5('123456789');setcookie('VerifyUser', $Data.$Seperator.md5($Data.$uniqueID));

if (

$_COOKIE) {
   $Cut = explode($Seperator, $_COOKIE['VerifyUser']);
   if (md5($Cut[0].$uniqueID) === $Cut[1]) {
       $_COOKIE['VerifyUser'] = $Cut[0];
   } else {
       die('Cookie data is invalid!!!');
   }
}

echo

$_COOKIE['VerifyUser'];?>

Create a unique id for your site and create a hash with md5($Data.$uniqueID). Attacker can understant that it must be re-hash after change cookie content.
But doesn't. Because cannot guess your unique id. Seperate your hash and data with seperator and send that cookie. Control that hash of returned value and your unique id's is same returned hash. Otherwise you have to stop attack. Sorry for my poor english!

<?php
  function set_cookie_fix_domain($Name, $Value = '', $Expires = 0, $Path = '', $Domain = '', $Secure = false, $HTTPOnly = false)
  {
    if (!empty($Domain))
    {
      // Fix the domain to accept domains with and without 'www.'.
      if (strtolower(substr($Domain, 0, 4)) == 'www.')  $Domain = substr($Domain, 4);
      $Domain = '.' . $Domain;// Remove port information.
      $Port = strpos($Domain, ':');
      if ($Port !== false)  $Domain = substr($Domain, 0, $Port);
    }header('Set-Cookie: ' . rawurlencode($Name) . '=' . rawurlencode($Value)
                          . (empty($Expires) ? '' : '; expires=' . gmdate('D, d-M-Y H:i:s', $Expires) . ' GMT')
                          . (empty($Path) ? '' : '; path=' . $Path)
                          . (empty($Domain) ? '' : '; domain=' . $Domain)
                          . (!$Secure ? '' : '; secure')
                          . (!$HTTPOnly ? '' : '; HttpOnly'), false);
  }
?>

Basically, if the domain parameter is supplied, it is converted to support a broader range of domains.  This behavior may or may not be desireable (e.g. could be a security problem depending on the server) but it makes cookie handling oh-so-much-nicer (IMO).

Furthermore the variable $_COOKIE["user_name"] will retain the value set by setcookie("user.name" ...) and no amount of calling setcookie("user_name" ...) will alter this value. This is rather trivially fixed by clearing the "user.name" cookie, but it can take a while to realize this since there's only "user_name" in $_COOKIE.

Hope this saves someone some time.

<?php
$cookiesSet = array_keys($_COOKIE);
for ($x=0;$x<count($cookiesSet);$x++) setcookie($cookiesSet[$x],"",time()-1);
?>

Very useful when doing logout scripts and the cookie name may have changed (long story).

Also, if the time is incorrect on your server, IE7 will also disallow those cookies from being set.

To overcome, include the header:

header('P3P:CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"');

before setting the cookie.

<?php
function build_cookie($var_array) {
  if (is_array($var_array)) {
    foreach ($var_array as $index => $data) {
      $out.= ($data!="") ? $index."=".$data."|" : "";
    }
  }
  return rtrim($out,"|");
}

function

break_cookie ($cookie_string) {
  $array=explode("|",$cookie_string);
  foreach ($array as $i=>$stuff) {
    $stuff=explode("=",$stuff);
    $array[$stuff[0]]=$stuff[1];
    unset($array[$i]);
  }
  return $array;
}
?>
Hopefully someone finds these useful.

<?php
#checking if form has been submitted
if (isset($_POST['submitted'])){
#if yes (form is submitted) assign values from POST array to variables
$newbgColor=$_POST['bgColor'];
$newtxtColor=$_POST['txtColor'];
#set cookies
setcookie("bgColor",$newbgColor,time()+3600);
setcookie("txtColor",$newtxtColor,time()+3600);

}

#in case user has come for first time and cookies are not set then
if ((!isset($_COOKIE['bgColor']) ) && (!isset($_COOKIE['txtColor']))){
$bgColor = "Black";
$txtColor="White";
}
#if cookies are set then use them
else{
$bgColor = $_COOKIE['bgColor'];
$txtColor = $_COOKIE['txtColor'];
}
?>
<!-- HTML Page-->
<html>
<body bgcolor="<?php echo $bgColor ?>" text="<?php echo $txtColor ?>">
<form action= "<?php echo $_SERVER['PHP_SELF']; ?>" method ="POST">
<p>Body Color:</p>
<select name=bgColor>
<option value ="Red">Red</option>
<option value ="Green" selected>Green</option>
<option value ="Blue">Blue</option>
<option value ="Yellow">Yellow</option>
<option value ="Black">Black</option>
<option value ="Brown">Brown</option>
<option value ="White">White</option>
</select>
<p>Text Color:</p>
<select name=txtColor>
<tion value ="Red">Red</option>
<option value ="Green" selected>Green</option>
<option value ="Blue">Blue</option>
<option value ="Yellow">Yellow</option>
<option value ="Black">Black</option>
<option value ="Brown">Brown</option>
<option value ="White">White</option>
</select>
<input type ="hidden" name="submitted" value="true"></br>
<input type="submit" value="remind">
</form>
</body>
</html>

Example :

- set -

<?php setcookie( "name", "value", "future_timestamp", "path", "domain" ); ?>



- delete -

<?php setcookie( "name", "value", "past_timestamp", "path", "domain" ); ?>



Jonathan

setcookie("w3p_cookie", "");

- - - -
One thing to *NOTE* is technically you can't update a cookie, you can only overwrite it with a new one with the same name.

- - - -

This creates a random number, stores it in a cookie, then references it on refresh, checks for duplicates and does necessary correction, then stores it again, rinse and repeat...

<?php
ob_start();
$MaxCount = 4;// set the max of the counter, in my tests "4" = (0,1,2,3) I adjusted below (+1) to get a "real" 4 (0,1,2,3,4) this is in reality 5 keys to humans, you can adjust script to eliminate "0", but my script makes use of the "0"$random =(rand()%($MaxCount+1));//give me a random number limited by the max, adding "1" because computers start counting at "0"if(!isset($_COOKIE['random'])){// check if random number cookie is not set
    //echo"not set";
    setcookie('random', $random);//set the cookie for the first time
    }else{
    $lastRandom= $_COOKIE['random']; //hold the last number if it was set before
    if($lastRandom == $random){//some logic to avoid repeats
     if($random < $MaxCount){//if below max, add 1
        $random++;
        //echo "under the max, adding 1, ";   
    }elseif($random >= ($MaxCount-1)){// if for some reason the random number is more than max or equal to it -1, and an additional -1 for max count in initial var (so in reality this -1 from intial max var, and -1 from $random which should be the same number)
            $random--;
            //echo "hit the max, subtracting 1, ";
        }else{
        $random++;
        //echo "no case match, adding 1, ";   
        }
    //echo "(".$lastRandom.", ".$random. "), they matched initally - was it fixed?";
    }else{
    //echo "(".$lastRandom.", ".$random. "), they DO NOT match";
    setcookie('random', $random);   
    }
    //echo"is set: {$_COOKIE['random']}";
}ob_end_flush();?>

<?php
$kaker = explode(";", $_SERVER['HTTP_COOKIE']);
foreach($kaker as $val){
    $k = explode("=", $val);
    echo trim($k[0]) . " => " . $k[1];
}// output
testcookie => value1hostonly
testcookie => value2subdom

?>

$cookie_string = 'set-cookie: name=value';

if (!preg_match('/Chrom[^ /]+/([0-9]+)[.0-9]* /', $_SERVER['HTTP_USER_AGENT'], $matches) || $matches[1]>66 && $matches[1]<84) {// match samesite=none compatible browsers
    $cookie_string.= '; samesite=none';
}

header($cookie_string, false);// set cookie

<?php
/**

     * A better alternative (RFC 2109 compatible) to the php setcookie() function

     *

     * @param string Name of the cookie

     * @param string Value of the cookie

     * @param int Lifetime of the cookie

     * @param string Path where the cookie can be used

     * @param string Domain which can read the cookie

     * @param bool Secure mode?

     * @param bool Only allow HTTP usage?

     * @return bool True or false whether the method has successfully run

     */

    function createCookie($name, $value='', $maxage=0, $path='', $domain='', $secure=false, $HTTPOnly=false)

    {

        $ob = ini_get('output_buffering');
// Abort the method if headers have already been sent, except when output buffering has been enabled

        if ( headers_sent() && (bool) $ob === false || strtolower($ob) == 'off' )

            return false;

        if ( !empty(

$domain) )

        {

            // Fix the domain to accept domains with and without 'www.'.

            if ( strtolower( substr($domain, 0, 4) ) == 'www.' ) $domain = substr($domain, 4);

            // Add the dot prefix to ensure compatibility with subdomains

            if ( substr($domain, 0, 1) != '.' ) $domain = '.'.$domain;
// Remove port information.

            $port = strpos($domain, ':');

            if (

$port !== false ) $domain = substr($domain, 0, $port);

        }
// Prevent "headers already sent" error with utf8 support (BOM)

        //if ( utf8_support ) header('Content-Type: text/html; charset=utf-8');
header('Set-Cookie: '.rawurlencode($name).'='.rawurlencode($value)

                                    .(empty($domain) ? '' : '; Domain='.$domain)

                                    .(empty($maxage) ? '' : '; Max-Age='.$maxage)

                                    .(empty($path) ? '' : '; Path='.$path)

                                    .(!$secure ? '' : '; Secure')

                                    .(!$HTTPOnly ? '' : '; HttpOnly'), false);

        return true;

    }
?>



Regards,

Isaak

<?php

    function SetCookieLive($name, $value='', $expire = 0, $path = '', $domain='', $secure=false, $httponly=false)

    {

        $_COOKIE[$name] = $value;

        return setcookie($name, $value, $expire, $path, $domain, $secure, $httponly);

    }

    function

RemoveCookieLive($name)

    {

        unset($_COOKIE[$name]);

        return setcookie($name, NULL, -1);

    }

?>

If you have a couple of environments for example, and are trying to set cookies on two domains:

example.com (main site)
dev.example.com (dev site)

In this case your (same named) cookies will interfere with each other if you're trying to set cookies with the domain parameter. 

Simply use an empty string for the domain parameter and the cookies will refer to each host separately.

If you use the subdomain www. on the main site this won't be an issue, but without a subdomain you'll have issues with reading each others' cookies.