Section 10.2. Using Cookies

10.2. Using Cookies

The setcookie( ) call needs to be before the HTML form because of the way the web works. HTTP operates by sending all "header" information before it sends "body" information. In the header, it sends things like server type (e.g., "Apache"), page size (e.g., "29019 bytes"), and other important data. In the body, it sends the actual HTML you see on the screen. HTTP works in such a way that header data cannot come after body datayou must send all your header data before you send any body data at all.

Cookies come into the category of header data. When you place a cookie using setcookie( ), your web server adds a line in your header data for that cookie. If you try and send a cookie after you have started sending HTML, PHP will flag serious errors and the cookie will not get placed.

There are two ways to correct this:

• Put your cookies at the top of your page. By sending them before you send anybody data, you avoid the problem entirely.

• Enable output buffering in PHP. This allows you to send header information such as cookies wherever you likeeven after (or in the middle of) body data. Output buffering is covered in depth in the following chapter.

The setcookie( ) function itself takes three main parameters: the name of the cookie, the value of the cookie, and the date the cookie should expire. For example:

     setcookie("Name", $_POST['Name'], time( ) + 31536000);

Cookies are sent to the server each time a user visits a page. So, if you set a cookie in a script, it does not become available until your user visits the next page (or hits refresh)this often confuses people who are desperately hunting for a bug.

In the example code, setcookie( ) sets a cookie called Name to the value set in a form element called Name. It uses time( ) + 31536000 as its third parameter, which is equal to the current time in seconds plus the number of seconds in a year, so that the cookie is set to expire one year from the time it was set.

Once set, the Name cookie will be sent with every subsequent page request, and PHP will make it available in $_COOKIE. Users can clear their cookies manually, either by using a special option in their web browser or just by deleting files.

The last three parameters of the setcookie( ) function allow you to restrict when it's sent, which gives you a little more control:

• Parameter four (path) allows you to set a directory in which the cookie is active. By default, this is / (active for the entire site), but you could set it to /messageboards/ to have the cookie only available in that directory and its subdirectories.

• Parameter five (domain) allows you to set a subdomain in which the cookie is active. For example, specifying "mail.yoursite.com" will make the cookie available there but not on www.yoursite.com. Use ".yoursite.com" to make the cookie available everywhere.

• Parameter six (secure) lets you specify whether the cookie must only be sent through a HTTPS connection or not. The default, 0, has the cookie sent across both HTTPS and HTTP, but you can set it to 1 to force HTTPS only.

Once a cookie has been set, it becomes available to use on subsequent page loads through the $_COOKIE superglobal array variable. Using the previous call to setcookie( ), subsequent page loads can have their Name value read like this:

     print $_COOKIE["Name"];