note 14648 deleted from function.setcookie by vincent
| From: | vincent@php.net | Date: | Wed, 10 Sep 2003 18:36:40 +0000 |
| Subject: | note 14648 deleted from function.setcookie by vincent | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-55964@lists.php.net to get a copy of this message | ||
Note Submitter: raynet@edu.lahti.fi
----
The well know "two-dots" issue with cookie domains might be solvable by using the correct
domain name, eg:
slashdot.org.
instead of
slashdot.org
the last dot is actually the root domain.
Also I've noticed no problems with cookies when I'm using the form:
setcookie("variablename","$variable");
In my opinion there is no need for the expiration field, or any other fields. Just do the stuff on
the server. Example:
$session_id = md5(uniqid(rand()));
<add $session_id to database with all the parameters/variables you are using>
setcookie("session_id",$session_id);
setcookie("session_exp",time()+3600);
The just fail the cookie if $session_exp is expired. Also you can leave the expire cookie because
you can store this information to DB.
Don't send plaintext in cookies, it just invites crackers to exploit your site.