note 72456 added to function.setcookie

You can be sure about the cookie files contents weren't changed. <?php $Seperator = '--'; $uniqueID = 'Ju?hG&F0yh9?=/6*GVfd-d8u6f86hp'; $Data = 'Ahmet '.md5('123456789'); setcookie('VerifyUser', $Data.$Seperator.md5($Data.$uniqueID)); if ($_COOKIE) { $Cut = explode($Seperator, $_COOKIE['VerifyUser']); if (md5($Cut[0].$uniqueID) === $Cut[1]) { $_COOKIE['VerifyUser'] = $Cut[0]; } else { die('Cookie data is invalid!!!'); } } echo $_COOKIE['VerifyUser']; ?> Create a unique id for your site and create a hash with md5($Data.$uniqueID). Attacker can understant that it must be re-hash after change cookie content. But doesn't. Because cannot guess your unique id. Seperate your hash and data with seperator and send that cookie. Control that hash of returned value and your unique id's is same returned hash. Otherwise you have to stop attack. Sorry for my poor english! ---- Server IP: 139.179.10.17 Probable Submitter: 88.242.68.202 ---- Manual Page -- http://www.php.net/manual/en/function.setcookie.php Edit -- https://master.php.net/note/edit/72456 Del: integrated -- https://master.php.net/note/delete/72456/integrated Del: useless -- https://master.php.net/note/delete/72456/useless Del: bad code -- https://master.php.net/note/delete/72456/bad+code Del: spam -- https://master.php.net/note/delete/72456/spam Del: non-english -- https://master.php.net/note/delete/72456/non-english Del: in docs -- https://master.php.net/note/delete/72456/in+docs Del: other reasons-- https://master.php.net/note/delete/72456 Reject -- https://master.php.net/note/reject/72456 Search -- https://master.php.net/manage/user-notes.php