note 110324 added to function.setcookie

Please note that setting the expiry to some timestamp in the past is a common way to get rid of a cookie. However, depending on the value you might set to "invalidate" a cookie immediately, this may pose a threat to the privacy of your user's data, especially when it comes to session cookies. If you write "0" and "expire-in-the-past" into a session cookie, it remains on the client-side until the clean-up mechanism of the browser hits. (That might be anything from no-time to a very long time. I'm not even thinking of app-based mobile browsers that won't close properly or do their best to ignore standards and RFCs and stuff...) So, if you have sufficiently messed up your ways of picking up existing session IDs and write-closing their data to your server, the session's data might move from file "sess_(random)" to "sess_0", because that is exactly the identifier that is referred in the cookie. From now on (at least until your server decides to clean up) there is data laying open wide to anyone requesting the session "0". Which may happen by accident (i.e. another user gains an own "0"-cookie) or malice (i.e. forgery). Long story short, ALWAYS use an empty string instead of a "0" value for invalidating a session cookie. ---- Server IP: 69.147.83.199 Probable Submitter: 37.24.77.12 ---- Manual Page -- http://www.php.net/manual/en/function.setcookie.php Edit -- https://master.php.net/note/edit/110324 Del: integrated -- https://master.php.net/note/delete/110324/integrated Del: useless -- https://master.php.net/note/delete/110324/useless Del: bad code -- https://master.php.net/note/delete/110324/bad+code Del: spam -- https://master.php.net/note/delete/110324/spam Del: non-english -- https://master.php.net/note/delete/110324/non-english Del: in docs -- https://master.php.net/note/delete/110324/in+docs Del: other reasons-- https://master.php.net/note/delete/110324 Reject -- https://master.php.net/note/reject/110324 Search -- https://master.php.net/manage/user-notes.php