PHP - Manual: setrawcookie

2024-12-20

setrawcookie

(PHP 5, PHP 7, PHP 8)

setrawcookie — 发送未经 URL 编码的 cookie

说明

setrawcookie(
    string $name,
    string $value = ?,
    int $expire = 0,
    string $path = ?,
    string $domain = ?,
    bool $secure = false,
    bool $httponly = false
): bool

setrawcookie() 和 setcookie() 非常相似，唯一不同之处是发送到浏览器的 cookie 值没有自动经过 URL 编码（urlencode）。

参数

相关参数的信息参见 setcookie() 的文档。

返回值

成功时返回 true，或者在失败时返回 false。

更新日志

版本	说明
5.5.0	发送给客户端的 Set-Cookie 头现在会加上 Max-Age 属性。
5.2.0	增加了 `httponly` 参数。

参见

setcookie() - 发送 Cookie

add a note

User Contributed Notes 6 notes

down

Brian ¶

16 years ago


Firefox is following the real spec and does not decode '+' to space...in fact it further encodes them to '%2B' to store the cookie.  If you read a cookie using javascript and unescape it, all your spaces will be turned to '+'.

To fix this problem, use setrawcookie and rawurlencode:


<?php

setrawcookie('cookie_name', rawurlencode($value), time()+60*60*24*365);

?>



The only change is that spaces will be encoded to '%20' instead of '+' and will now decode properly.

down

subs at voracity dot org ¶

15 years ago


setrawcookie() isn't entirely 'raw'. It will check the value for invalid characters, and then disallow the cookie if there are any. These are the invalid characters to keep in mind: ',;<space>\t\r\n\013\014'.

Note that comma, space and tab are three of the invalid characters. IE, Firefox and Opera work fine with these characters, and PHP reads cookies containing them fine as well. However, if you want to use these characters in cookies that you set from php, you need to use header().

down

Sebastian ¶

10 years ago


You really shouldn't use (un)serialize with cookies. An evil user could inject ANY code in your script.

down

sageptr at gmail dot com ¶

9 years ago


If you want to pass something and unserialize later, you should somehow sign value to ensure evil user don't modify it.
For example, calculate hash sha1($value.$securekey) and place it to different cookie. If cookie value mismatch hash - simple discard both.
This technique you can use in any case if you want to protect cookie from modification, but it can't protect from deletion or from setting to other valid cookie (old or stolen from other user).

down

-6

lgb ¶

12 years ago


After having several problems with this cookie thing, I'm using base64_encode on the data I put into a cookie, so I can avoid problems, I had before. I tried to set up cookie with data created by serialize() from a PHP array, but it did not work to be able to get it back, after I modified it to use value of base64_encode(serialize(...)) to set up the cookie, and unserialize(base64_decode(..)) to get back the value, everything started to work.

down

-39

kexianbin at diyism dot com ¶

10 years ago


my php cookie value encode function:

<?php
function encode_cookie_value($value)
         {return strtr($value,
                       array_combine(str_split($tmp=",; \t\r\n\013\014"),
                                     array_map('rawurlencode', str_split($tmp))
                                    )
                      );
         }
setrawcookie('kk', encode_cookie_value('jk=jk?jk-/":jk;jk jk,jk'));
?>

add a note

官方地址：https://www.php.net/manual/en/function.setrawcookie.php

有任何技术问题请点击这里网站运营推广招聘

IT PHP 编程语言 Linux 开发编程科技 Elasticsearch HTML/CSS/XML 网络数据库 JAVA 面试 NoSQL C/C++ Golang Git 算法操作系统正则表达式 Redis 互联网 MySql JavaScript 运维软件国际架构设计 Mac OS TCP/IP Excel Vim Windows Socket Oracle VR MongoDB Python 运营 MemCache 商业硬件电子娱乐设计 nginx 摄影游戏 WordPress HTTP 团建数码电器

php7 安装fileinfo扩展 preg_split — 通过一个正则表达式分隔字符串 php位值,解决 PHP 中 usort 在值相同时改变原始位置的问题 [PHP] inet_pton/inet_ntop IP地址转换函数 PHP 8.1 [鸟哥]PHP_INT_MIN 和 -9223372036854775808 adodb手册 ADORecordSet对象 opcache预加载 Composer的Packagist资源 array_multisort() 多字段排序 PHPMailer设置utf8 PHPMailer字符集CharSet PHP json解析（json_decode）页面工具 mysql面试题纯php实现DES以及TripleDES加密算法 php中几种注释规范两千行PHP学习笔记 php 修改图片大小支持php7的性能采集扩展利用PHP SOAP实现WEB SERVICE

略微加速

PHP官方手册 - 互联网笔记

setrawcookie

说明

参数

返回值

更新日志

参见

User Contributed Notes 6 notes