PHP A to ZCE: Cookies

Cookies are used to store data on the computer of somebody who visits your web site. In this article I will show you how cookies work and how you can read and write cookies.

How Cookies Work

A cookie is made up of the following parts:

• The name and value
• Expiry timestamp (optional; if omitted the cookie stays alive until the browser is closed)
• Domain and path (these are optional; if omitted defaults the current domain and path).

The process for writing and reading cookies is as follows:

• A cookie is set in a client's browser in the HTTP response headers. This is achieved using the Set-Cookie header
• The server sends one Set-Cookie header for every cookie to be set
• When a browser subsequently requests a page it sends the Cookie header containing the name and value of all cookies previously set on the matching domain and path.

For instance, to set one cookie called foo with a value of bar another called c2 with a value of 123, the server includes the following header:

Set-Cookie: foo=bar; expires=Wed, 10-Nov-2010 04:29:35 GMT
Set-Cookie: c2=123; expires=Wed, 10-Nov-2010 04:29:35 GMT

Cookies are included in the request in name=val format, each of which is separated by a semi-colon. If the browser reloads the page that sets the above cookies, it will include the following header in the request:

Cookie: foo=bar; c2=123

Writing Cookies

• The simplest way to set a cookie is to use the setcookie() function
• You can also use setrawcookie() - This is identical except it will not automatically URL-encode the cookie value
• Since cookies are set in the HTTP response headers, you must call setcookie() prior to any other page output
• You can get around this restriction using output buffering (see ob_start()).

The setcookie() function definition is as follows. The function returns true is the header was set, false if not.

bool setcookie ( 
    string $name,
    string $value  = '', 
    int $expire    = 0, 
    string $path   = '', 
    string $domain = '',
    bool $secure   = false 
    bool $httponly = false 
)

Some notes about this function:

• The only required parameter is $name
• The $expiry parameter accepts a Unix timestamp (PHP will convert it into the correct format)
• For instance, the expiry for a cookie that last one day would be time() + 86400.

Removing a Cookie

To remove a cookie, call setcookie() and set an expiry date in the past.

<?php
    setcookie('ctr', '', time() - 86400);
?>

Reading Cookies

• Cookies can be read from the superglobal variable $_COOKIE
• For instance, if you set a cookie called ctr, you can read the value from $_COOKIE['ctr'].

Sample Cookie Usage

The following script demonstrates how use a value stored in a cookie:

<?php
    // check if the cookie is set
    if (isset($_COOKIE['ctr'])) {
        $ctr = $_COOKIE['ctr'];
    }
    else {
        // cookie not set, initialize the value
        $ctr = 0;
    }
 
    // increment the cookie value
    setcookie('ctr', $ctr + 1);
 
    // output the value - this must
    echo $ctr;
?>

Further Reading

• PHP Manual: Cookies
• PHP Manual: $_COOKIE
• PHP Manual: setcookie()
• PHP Manual: setrawcookie()

Other Options

• Download a PDF version of this article
• Put your PHP knowledge to the test with our online and iPad/iPhone quizzes
• View or post comments for this article
• Browse similar articles by tag: PHP, ZCE
• Read related articles:
  • PHP A to ZCE: Arrays
  • PHP A to ZCE: Bitwise Operations
  • PHP A to ZCE: Databases and SQL
  • PHP A to ZCE: Error Handling
  • PHP A to ZCE: Functions