note 66331 added to function.setcookie

You can be sure about the cookie files contents weren't changed. <?php $Seperator = '--'; $uniqueID = 'Ju?hG&F0yh9?=/6*GVfd-d8u6f86hp'; $Data = 'Ahmet '.md5('123456789'); setcookie('VerifyUser', $Data.$Seperator.md5($Data.$uniqueID)); if ($_COOKIE) { $Cut = explode($Seperator, $_COOKIE['VerifyUser']); if (md5($Cut[0].$uniqueID) === $Cut[1]) { $_COOKIE['VerifyUser'] = $Cut[0]; } else { die('Cookie data is invalid!!!'); } } echo $_COOKIE['VerifyUser']; ?> Create a unique id for your site and create a hash with md5($Data.$uniqueID). Attacker can understant that it must be re-hash after change cookie content. But doesn't. Because cannot guess your unique id. Seperate your hash and data with seperator and send that cookie. Control that hash of returned value and your unique id's is same returned hash. Otherwise you have to stop attack. Sorry for my poor english! ---- Server IP: 139.179.10.17 Probable Submitter: 85.102.107.163 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.setcookie.php Edit -- http://master.php.net/note/edit/66331 Del: integrated -- http://master.php.net/note/delete/66331/integrated Del: useless -- http://master.php.net/note/delete/66331/useless Del: bad code -- http://master.php.net/note/delete/66331/bad+code Del: spam -- http://master.php.net/note/delete/66331/spam Del: non-english -- http://master.php.net/note/delete/66331/non-english Del: in docs -- http://master.php.net/note/delete/66331/in+docs Del: other reasons-- http://master.php.net/note/delete/66331 Reject -- http://master.php.net/note/reject/66331 Search -- http://master.php.net/manage/user-notes.php