Adding Parameters to a Cookie

I l @ ve RuBoard

Although passing just the name and value arguments to the setcookie() function will suffice for most of your cookie uses, you ought to be aware of the other arguments available. The function can take up to four more arguments, each of which will limit the operation of the cookie.

 setcookie ("name", "value", "expiration",  "path", "domain", "secure"); 

The expiration argument is used to set a specific length of time for a cookie to exist. If it is not specified, the cookie will continue to be functional until the user closes their browser. Normally the expiration time is set by adding a particular number of minutes or hours to the current time.This line of code will set the expiration time of the cookie to be one hour (60 seconds times 60 minutes) from the current moment:

 setcookie ("name", "value", time()_+  "3600"); 

Because the expiration time will be calculated as the value of time() plus 3600, this particular argument is not put in quotes (as you do not want to literally pass time() + 3600 as the expiration but rather the result of that calculation).

The path and domain arguments are used to limit a cookie to a specific folder within a Web site (the path) or to a specific domain. For example, you could limit the life of a cookie to exist only while a user is within their folder of the domain:

 setcookie ("name", "value", time()_+ 3600,  "/user/"); 

The secure value dictates that a cookie should only be sent over a secure HTTPS connection. A 1 indicates that a secure connection must be used, a 0 indicates that a secure connection is not necessary. You would want to insure a secure connection for e-commerce sites.

 setcookie ("name", "value", time()_+   "3600", "", "", "1"); 

As with all functions that take arguments, you must pass all the values in order. In the above example, I did not want to specify (or limit) the path and domain so I used empty quotes to indicate such. By doing so I maintained the proper number of arguments and was still able to indicate that a HTTPS connection was necessary.

Let's add an expiration date to the existing cookies.php page so that the user's preferences will remain even after they have closed their browser and returned to the site.

To set a cookie's expiration date:

1. Open cookies.php in your text editor (Script 12.1).

2. Change the two setcookie() lines to include an expiration date that's several days or more away (Script 12.2):

   Script 12.2. By adding the expiration arguments to the two cookies, the cookies will continue to persist even after the user has closed out of and returned to their browser.

   

   

    setcookie("BGColor","$NewBGColor",  time()+ "10000000"); setcookie("TextColor",   "$NewTextColor", time()+   "10000000"); 

   By setting the expiration date to time() + "10000000", the cookie will continue to exist for approximately 116 days after it is set (60 seconds * 60 minutes * 24 hours * 115 days is approximately 10000000).

3. Save the script, load it to the server, and test it in your Web browser (Figures 12.9 and 12.10).

   Figure 12.9. The addition of the expiration argument is reflected in the message the user sees regarding the cookie.

   

   Figure 12.10. Because the expiration date of the cookies was set months into the future, the user's preferences, which are stored in the cookies, will still be valid even after the user has closed and reopened the browser as I've done here. Without this expiration date, the user would see the default colors and have to reassign their preferences with every new browser session.

   

Tip

Some programmers report that specific versions of Netscape and Internet Explorer have difficulties with cookies that do not list every argument. If you think this is going to be an issue for your Web site, you can pass every argument by using empty quotation marks to represent default values:

 setcookie("BGColor", "$NewBGColor",   time()[phone], "", "", ""); 

Tip

There is really no rule of thumb for what kind of expiration date to use with your cookies. Here are some general guidelines, though: if the cookie should last as long as the session, do not set an expiration time; if the cookie should continue to exist after the user has closed and reopened their browser, set an expiration time months ahead; and, if the cookie can constitute a security risk, set an expiration time of an hour or fraction thereof so that the cookie does not continue to exist too long after a user has left their browser.

Tip

For security purposes, you could set a five or ten minute expiration time on a cookie and have the cookie resent with every new page the user visits . This way the cookie will continue to persist as long as the user is active but will automatically die five or ten minutes after the user's last action.

I l @ ve RuBoard