#32827 [Opn->Csd]: New cookie behaviour is breaking backward compatibility

ID: 32827 Updated by: sniper@php.net Reported By: sesser@php.net -Status: Open +Status: Closed -Bug Type: Unknown/Other Function +Bug Type: *General Issues Operating System: all PHP Version: 4CVS-2005-04-25 (stable) New Comment: This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2005-04-25 23:03:28] sesser@php.net Description: ------------ Recent changes in cookie handling breaks backward compatibility. The netscape cookie specification says about commas in Set-Cookie header: If there is a need to place such data in the name or value, some encoding method such as URL style %XX encoding is recommended, though no encoding is defined or required. Read RECOMMENDED, BUT NOT REQUIRED. Additionally this limitation only covers name=value in Set-Cookie and not Cookie name=opaque_strings. PHP's Set-Cookie does not allow sending plain commas as Cookie, but that does not change the fact, that anyone can set a Cookie via Java Script with a plain comma in it or use another script language that runs on the same server and is part of the application. Browsers happily send them in plain back. Lots of sites, especially those with FALK.ag ad banners have plain commas in there cookies. It is not longer possible for PHP script on those servers to handle these cookies. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=32827&edit=1