PHP cookies

初次通过php操作cookies出现了不少问题，php官方文档说的又不是足够清晰：

 

简单介绍一下设置和读取cookies

设置cookies:

/** * Send a cookie * @link http://php.net/manual/en/function.setcookie.php * @param name string <p> * The name of the cookie. * </p> * @param value string[optional] <p> * The value of the cookie. This value is stored on the clients * computer; do not store sensitive information. * Assuming the name is 'cookiename', this * value is retrieved through $_COOKIE['cookiename'] * </p> * @param expire int[optional] <p> * The time the cookie expires. This is a Unix timestamp so is * in number of seconds since the epoch. In other words, you'll * most likely set this with the time function * plus the number of seconds before you want it to expire. Or * you might use mktime. * time()+60*60*24*30 will set the cookie to * expire in 30 days. If set to 0, or omitted, the cookie will expire at * the end of the session (when the browser closes). * </p> * <p> * <p> * You may notice the expire parameter takes on a * Unix timestamp, as opposed to the date format Wdy, DD-Mon-YYYY * HH:MM:SS GMT, this is because PHP does this conversion * internally. * </p> * <p> * expire is compared to the client's time which can * differ from server's time. * </p> * </p> * @param path string[optional] <p> * The path on the server in which the cookie will be available on. * If set to '/', the cookie will be available * within the entire domain. If set to * '/foo/', the cookie will only be available * within the /foo/ directory and all * sub-directories such as /foo/bar/ of * domain. The default value is the * current directory that the cookie is being set in. * </p> * @param domain string[optional] <p> * The domain that the cookie is available. * To make the cookie available on all subdomains of example.com * then you'd set it to '.example.com'. The * . is not required but makes it compatible * with more browsers. Setting it to www.example.com * will make the cookie only available in the www * subdomain. Refer to tail matching in the * spec for details. * </p> * @param secure bool[optional] <p> * Indicates that the cookie should only be transmitted over a * secure HTTPS connection from the client. When set to true, the * cookie will only be set if a secure connection exists. The default * is false. On the server-side, it's on the programmer to send this * kind of cookie only on secure connection (e.g. with respect to * $_SERVER["HTTPS"]). * </p> * @param httponly bool[optional] <p> * When true the cookie will be made accessible only through the HTTP * protocol. This means that the cookie won't be accessible by * scripting languages, such as JavaScript. This setting can effectively * help to reduce identity theft through XSS attacks (although it is * not supported by all browsers). Added in PHP 5.2.0. * true or false * </p> * @return bool If output exists prior to calling this function, * setcookie will fail and return false. If * setcookie successfully runs, it will return true. * This does not indicate whether the user accepted the cookie. */ function setcookie ($name, $value = null, $expire = null, $path = null, $domain = null, $secure = null, $httponly = null) {}

 

读取cookies:

$_COOKIES["your_key"]

$_COOKIES是一个数组变量

 

删除cookies:

删除cookies跟设置cookies是一样的，使用同一个function. 如setcookie("testcookie", '');

 

用winsock抓包，观察返回的http头，可以发现http头是“Set-Cookie: testcookie=deleted; expires=Mon, 18-Jun-2007 02:42:33 GMT”，这说明“setcookie("testcookie", '');”的的确确是将testcookie这个cookie直接删除，而关于这种情况在php手册中完全没有说明。

 

查看源代码就一清二楚了：

以下代码可以在php5.20的linux源码包中ext/standard/head.c第99行附近找到：

if (value && value_len == 0) { /* * MSIE doesn't delete a cookie when you set it to a null value * so in order to force cookies to be deleted, even on MSIE, we * pick an expiry date 1 year and 1 second in the past */ time_t t = time(NULL) - 31536001; dt = php_format_date("D, d-M-Y H:i:s T", sizeof("D, d-M-Y H:i:s T")-1, t, 0 TSRMLS_CC); sprintf(cookie, "Set-Cookie: %s=deleted; expires=%s", name, dt); efree(dt); } else { sprintf(cookie, "Set-Cookie: %s=%s", name, value ? encoded_value : ""); if (expires > 0) { strcat(cookie, "; expires="); dt = php_format_date("D, d-M-Y H:i:s T", sizeof("D, d-M-Y H:i:s T")-1, expires, 0 TSRMLS_CC); strcat(cookie, dt); efree(dt); } }

来自：http://www.zzsky.cn/build/content/1545.htm

 

在应用中，我这么使用过：setcookie("LOGIN_MEMBER","",time(), "/"); //删除所有目录下的叫LOGIN_MEMBER的cookies.

 

 

参数介绍：

第一个：name,必选参数，这个是cookie的变量名，可以通过$_COOKIE['user']调用变量名为user的cookie.
第二：value,可选参数，这个cookie变量的值,比如说setcookie("user","php"),我们通过调用$_COOKIE['user']可以得到php值;
第三个：expire,可选参数，这个是用来设置cookie变量保存的时间，注意是我们设置的的UNIX时间戳减去当前的UNIX时间戳才是 cookie变量保存的时间。（UNIX时间戳：是从1970年1月1日（UTC/GMT的午夜）开始所经过的秒数) ，一般我们可以通过time()函数获取当前的UNIX时间戳，再加上我们要保存的时间（单位为秒）比如说，setcookie("user","php",time()+3600),这样我们就可以保存user这个cookie变量的时间为3600秒。另外我们可以通过设置的时间戳小于当前的时间戳来删除cookie变量，比如说setcookie("user","php",time()-1)这样我们就删除了user这个cookie变量了。

第四个：path,cookie的有效范围，这个参数是下一个参数domain基础上的有效范围，如果path设置为"/"，那就是在整个 domain都有效，比如setcookie("user","php",time()+3600,"/"),这样我们domain下的任何目录，任何文件都可以通过$_COOKIE['user']来调用这个cookie变量的值。如果path设置为"/test",那么只在domain下的/test 目录及子目录才有效，比如domain下有两个目录: test1,test2,我们设置为setcookie("user","php,time()+3600,"/test1")，那么只有test1目录下才能通过$_COOKIE['user']调用user这个cookie变量的值，test2目录下获取不到。

第五个：domain,cookie有效的域名，如果domain,设置为phpzixue.cn，那么在phpzixue.cn下的所有子域都有效。假设phpzixue.cn有两个子域，php.phpzixue.cn，css.phpzixue.cn，我们设置为 setcookie("user","php",time()+3600,"/","php.phpzixue.cn"),那么只有在 php.phpzixue.cn这个子域下才能获取user这个cookie变量的值. 再举一个例子：setcookie("user","php",time()+3600,"/test","php.phpzixue.cn"),那么只有在php.phpzixue.cn这个子域下的test目录下才能获取user这个cookie变量的值.
第六个：secure，值cookie是否仅通过安全的https,值为0或1，如果值为1，则cookie只能在https连接上有效，默认值为 0，表示cookie在http和https连接上都有效。
使用cookie技术计算网站的月访问量：
参考：http://www.itwis.com/html/php/phpskill/20100413/8092.html

 

之前因为第四个参数没有设置，导致不同目录下cookies不能共享。