Wondering about cookie and their pitfalls.

[Sims]

Hi,

I am using setcookies to store one single value.
But i was reading http://za2.php.net/manual/en/function.setcookie.php and i
noticed that a cookie might not be accepted yet it might return true.

So that makes me wonder what the use of the cookies are if i have no way of
making sure that it has been properly accepted.
What is the point of having cookies if i have to make a backup plan for
users that do not accept them? What do you do for those users?

Am i right in assuming that cookies are only used as a bonus, for example to
remember a user name and some minor settings.

Now for my variable, how can i remember the value even if the user refreshes
the page?

I have global values like...

if( !isset($foo) ){
$foo = "value is set";
echo "Setting foo";
}else{
echo "foo is".$foo;
}

if i load the page $foo is set but then is i refresh the page the value is
lost, why?
Why does php not remember the global value $foo?

I tried
$HTTP_GET_VARS['foo'] = $foo;
$HTTP_POST_VARS['foo']= $foo;

But that does not save the value when the page is refreshed, (the same page
is refreshed).

Sims

[Pedro Graca]

Re: Wondering about cookie and their pitfalls.

["Followup-To:" header set to comp.lang.php.]
Sims wrote:[color=blue]
> I am using setcookies to store one single value.
> But i was reading http://za2.php.net/manual/en/function.setcookie.php and i
> noticed that a cookie might not be accepted yet it might return true.
>
> So that makes me wonder what the use of the cookies are if i have no way of
> making sure that it has been properly accepted.
> What is the point of having cookies if i have to make a backup plan for
> users that do not accept them? What do you do for those users?[/color]

Plan without cookies (same as JavaScript)
[color=blue]
> Am i right in assuming that cookies are only used as a bonus, for example to
> remember a user name and some minor settings.[/color]

That's what I do.
[color=blue]
> Now for my variable, how can i remember the value even if the user refreshes
> the page?[/color]
(snip)


To remember a variable between accesses use session variables:


<?php // page1.php
session_start() ;

$_SESSION['remember_me'] = 'OK!';
echo 'goto <a href="page2.php ">page 2</a>.';
?>


<?php // page2.php
session_start() ;

if (isset($_SESSIO N['remember_me'])) {
echo 'On page 1 I was set to ', $_SESSION['remember_me'];
} else {
header('Locatio n: page1.php'); // should be a full URL
// some browsers/proxies may not follow the redirection
exit('Redirecte d to <a href="page1.php ">page 1</a>.');
}
?>


As for cookies I only think of them (apart from session management,
which is automatically managed by PHP) towards the very end of the
development, to make it easier/friendlier to the user.
--
--= my mail box only accepts =--
--= Content-Type: text/plain =--
--= Size below 10001 bytes =--

[Sims]

Re: Wondering about cookie and their pitfalls.

[color=blue][color=green]
> >
> > So that makes me wonder what the use of the cookies are if i have no way[/color][/color]
of[color=blue][color=green]
> > making sure that it has been properly accepted.
> > What is the point of having cookies if i have to make a backup plan for
> > users that do not accept them? What do you do for those users?[/color]
>
> Plan without cookies (same as JavaScript)[/color]

I guess that is what i will do.
[color=blue]
>[color=green]
> > Now for my variable, how can i remember the value even if the user[/color][/color]
refreshes[color=blue][color=green]
> > the page?[/color]
> (snip)
>
>
> To remember a variable between accesses use session variables:
>[/color]
[snip code]

Thanks for the code, i just have one question.
phpbb, (www.phpbb.com), uses a cookie to check if a user is logged in.

the code is, (in session.php, line 200).

if ( isset($HTTP_COO KIE_VARS[$cookiename . '_sid']) ||
isset($HTTP_COO KIE_VARS[$cookiename . '_data']) )
{
$sessiondata = isset( $HTTP_COOKIE_VA RS[$cookiename . '_data'] ) ?
unserialize(str ipslashes($HTTP _COOKIE_VARS[$cookiename . '_data'])) :
array();
$session_id = isset( $HTTP_COOKIE_VA RS[$cookiename . '_sid'] ) ?
$HTTP_COOKIE_VA RS[$cookiename . '_sid'] : '';
$sessionmethod = SESSION_METHOD_ COOKIE;
}

they do not use sessions at all.
Now to save a single variable is session 100% reliable? Why would they not
use sessions and rather use cookies?
[color=blue]
>
>
> As for cookies I only think of them (apart from session management,
> which is automatically managed by PHP) towards the very end of the
> development, to make it easier/friendlier to the user.[/color]

Agreed.
Thanks

Sims

[Pedro Graca]

Re: Wondering about cookie and their pitfalls.

["Followup-To:" header set to comp.lang.php.]
Sims wrote:[color=blue]
> Thanks for the code, i just have one question.
> phpbb, (www.phpbb.com), uses a cookie to check if a user is logged in.
>
> the code is, (in session.php, line 200).
>
> if ( isset($HTTP_COO KIE_VARS[$cookiename . '_sid']) ||
> isset($HTTP_COO KIE_VARS[$cookiename . '_data']) )
> {
> $sessiondata = isset( $HTTP_COOKIE_VA RS[$cookiename . '_data'] ) ?
> unserialize(str ipslashes($HTTP _COOKIE_VARS[$cookiename . '_data'])) :
> array();
> $session_id = isset( $HTTP_COOKIE_VA RS[$cookiename . '_sid'] ) ?
> $HTTP_COOKIE_VA RS[$cookiename . '_sid'] : '';
> $sessionmethod = SESSION_METHOD_ COOKIE;
> }
>
> they do not use sessions at all.
> Why would they not use sessions and rather use cookies?[/color]

Can't answer that.

Session management was put into PHP in version 4. Maybe phpbb started
creating their scripts when sessions weren't available and they think
it's too much trouble to switch now.

Same thing for lots of scripts out there that rely on register_global s
being "on" ...

[color=blue]
> Now to save a single variable is session 100% reliable?[/color]

Well ... the session ID has to be sent to the client and back to the
server. This can be done with cookies, through the URL or in hidden
form fields. Any of this ways can be exploited for "session hijacking".

But, yes ... session variables are 100% reliable :)
--
--= my mail box only accepts =--
--= Content-Type: text/plain =--
--= Size below 10001 bytes =--

[Brian Evans]

Re: Wondering about cookie and their pitfalls.

Sims wrote:[color=blue]
> Thanks for the code, i just have one question.
> phpbb, (www.phpbb.com), uses a cookie to check if a user is logged in.
>
> the code is, (in session.php, line 200).
>
> if ( isset($HTTP_COO KIE_VARS[$cookiename . '_sid']) ||
> isset($HTTP_COO KIE_VARS[$cookiename . '_data']) )
> {
> $sessiondata = isset( $HTTP_COOKIE_VA RS[$cookiename . '_data'] ) ?
> unserialize(str ipslashes($HTTP _COOKIE_VARS[$cookiename . '_data'])) :
> array();
> $session_id = isset( $HTTP_COOKIE_VA RS[$cookiename . '_sid'] ) ?
> $HTTP_COOKIE_VA RS[$cookiename . '_sid'] : '';
> $sessionmethod = SESSION_METHOD_ COOKIE;
> }
>
> they do not use sessions at all.
> Now to save a single variable is session 100% reliable? Why would they not
> use sessions and rather use cookies?[/color]

phpBB does not use the native sessions of PHP for a couple of reasons:

1) phpBB 2.0.x is designed to be compatible with PHP 3.0.9 and up (2.2.x
will require some version of 4.x). As such, phpBB has to deal with
certain array functions as well as sessions.
2) If the site has some other parts to the site that are separate from
the forum, the forum won't mess with these other sections
3) phpBB uses a really tight (perhaps even paranoid) control on the
session, doing things like IP checks.

But the big one is the PHP3 compatibility. As said the next version they
are working on will require PHP4, but I don't know how the sessions will
be effected (haven't looked at the code much). If you don't want to code
your own session methods, you might as well use the built in ones for PHP.

[Sims]

Re: Wondering about cookie and their pitfalls.

[color=blue]
>
> phpBB does not use the native sessions of PHP for a couple of reasons:
>
> 1) phpBB 2.0.x is designed to be compatible with PHP 3.0.9 and up (2.2.x
> will require some version of 4.x). As such, phpBB has to deal with
> certain array functions as well as sessions.[/color]

I see,
[color=blue]
> 2) If the site has some other parts to the site that are separate from
> the forum, the forum won't mess with these other sections
> 3) phpBB uses a really tight (perhaps even paranoid) control on the
> session, doing things like IP checks.[/color]

I am not sure i really follow you. I am not quite sure i understand point 2
and 3.
[color=blue]
> But the big one is the PHP3 compatibility. As said the next version they
> are working on will require PHP4, but I don't know how the sessions will
> be effected (haven't looked at the code much). If you don't want to code
> your own session methods, you might as well use the built in ones for PHP.[/color]

I just need to store one value, (the rest is all stored in the DB).
The number is only really needed when the user refreshes a page, (as the
unique number seems to get lost).

You said something about my own session method, would you have some code for
it.

Many thanks

[Saul]

Re: Wondering about cookie and their pitfalls.

"Sims" <siminfrance@ho tmail.com> wrote in message news:<c0uvpk$1b j1g1$1@ID-162430.news.uni-berlin.de>...[color=blue][color=green]
> >
> > phpBB does not use the native sessions of PHP for a couple of reasons:
> >
> > 1) phpBB 2.0.x is designed to be compatible with PHP 3.0.9 and up (2.2.x
> > will require some version of 4.x). As such, phpBB has to deal with
> > certain array functions as well as sessions.[/color]
>
> I see,
>[color=green]
> > 2) If the site has some other parts to the site that are separate from
> > the forum, the forum won't mess with these other sections
> > 3) phpBB uses a really tight (perhaps even paranoid) control on the
> > session, doing things like IP checks.[/color]
>
> I am not sure i really follow you. I am not quite sure i understand point 2
> and 3.
>[color=green]
> > But the big one is the PHP3 compatibility. As said the next version they
> > are working on will require PHP4, but I don't know how the sessions will
> > be effected (haven't looked at the code much). If you don't want to code
> > your own session methods, you might as well use the built in ones for PHP.[/color]
>
> I just need to store one value, (the rest is all stored in the DB).
> The number is only really needed when the user refreshes a page, (as the
> unique number seems to get lost).
>
> You said something about my own session method, would you have some code for
> it.
>
> Many thanks[/color]

Sessions also require a session cookie on the computer, or for a
session_id in the URL as a get variable. If you just have one value to
store I'd put it in the URL if you are worried about cookies. If you
want it to be private then make it a session variable and allow the
session_id to put in the URL.

On a related point, sessions and cookies on WAP-based sites can be
particularly unfriendly to programmer.


Saul

[Sims]

Re: Wondering about cookie and their pitfalls.

[color=blue]
>
> Sessions also require a session cookie on the computer, or for a
> session_id in the URL as a get variable. If you just have one value to
> store I'd put it in the URL if you are worried about cookies. If you
> want it to be private then make it a session variable and allow the
> session_id to put in the URL.
>[/color]

Yes it is what i do but the problem comes when the user comes to my site i
assign them a ID
but if the user refreshes that pages then the number that i just assigned is
not saved.
It is saved on subsequent pages but not the original one

so

https://www.yourdomain.com

if( !isset($ID)){ 101010101;}

//user reload/refresh the page.

and $ID, not set... I cannot save it as a $_POST or $_VAR or anything.

Sims

[R. Rajesh Jeba Anbiah]

Re: Wondering about cookie and their pitfalls.

"Sims" <siminfrance@ho tmail.com> wrote in message news:<c0ttad$1b nb87$1@ID-162430.news.uni-berlin.de>...[color=blue]
> Hi,
>
> I am using setcookies to store one single value.
> But i was reading http://za2.php.net/manual/en/function.setcookie.php and i
> noticed that a cookie might not be accepted yet it might return true.
>
> So that makes me wonder what the use of the cookies are if i have no way of
> making sure that it has been properly accepted.
> What is the point of having cookies if i have to make a backup plan for
> users that do not accept them? What do you do for those users?
>
> Am i right in assuming that cookies are only used as a bonus, for example to
> remember a user name and some minor settings.
>
> Now for my variable, how can i remember the value even if the user refreshes
> the page?
>
> I have global values like...
>
> if( !isset($foo) ){
> $foo = "value is set";
> echo "Setting foo";
> }else{
> echo "foo is".$foo;
> }
>
> if i load the page $foo is set but then is i refresh the page the value is
> lost, why?
> Why does php not remember the global value $foo?
>
> I tried
> $HTTP_GET_VARS['foo'] = $foo;
> $HTTP_POST_VARS['foo']= $foo;[/color]

IMHO, you cannot stuff variables to GET or POST array like that.
Also, you use some obsolete style. The new/prefered style should be
$_GET & $_POST. If you want to stuff to global array, you may consider
session ($_SESSION) or cookies (note with setcookie() only).

setcookie() will return TRUE or FALSE. So, what is your question?
Probably you may need to rephrase your question so that we clearly
understand what you want to do.

--
"Success is not what you achieve, but it is what you die for"
If you live in USA, please support John Edwards.
Email: rrjanbiah-at-Y!com

[Sims]

Re: Wondering about cookie and their pitfalls.

[color=blue]
> IMHO, you cannot stuff variables to GET or POST array like that.
> Also, you use some obsolete style. The new/prefered style should be
> $_GET & $_POST. If you want to stuff to global array, you may consider
> session ($_SESSION) or cookies (note with setcookie() only).
>
> setcookie() will return TRUE or FALSE. So, what is your question?
> Probably you may need to rephrase your question so that we clearly
> understand what you want to do.
>[/color]

Thanks, for your reply.
You can read all the other replies to see what the others on this NG
understood.

I am not sure myself what is confusing you.

I set some value in my page and that value is lost when the user refreshes
the page that created the value.
So i thought of using cookies but then i realized that not all users could
use cookies and that made me wonder what the user of cookies might be as
they are unreliable.

BTW setcookies will return true even if it is not accepted by the user and
the setting of the values was for testing purposes only, (although i do not
see/believe/understand what you mean when you say "you cannot stuff
variables to GET or POST array like that").

Regards.
Sims

[Pedro Graca]

Re: Wondering about cookie and their pitfalls.

["Followup-To:" header set to comp.lang.php.]
Sims wrote:[color=blue]
> I tried
> $HTTP_GET_VARS['foo'] = $foo;
> $HTTP_POST_VARS['foo']= $foo;[/color]

$_GET and $_POST are arrays that behave just like any other variable in
PHP (except that they get initialized by values the browser sent to the
server). After the script starts, you can do whatever you want with
them; but I like to keep $_POST with /only/ the data POSTed to the
server and $_GET with /only/ the data in the URL -- the same goes for
almost all other super global variables ($_FILES, $_COOKIE, $_SERVER,
$_ENV, and $_REQUEST). $_SESSION is a case apart because it's the only
one that keeps its value between accesses (as long as sessions are
working and you don't forget to session_start() in all pages that use it).

If you want a super global and do not want it saved between sessions,
put it in the previously unmentioned superglobal -- $GLOBALS.
For example:

<?php
$credit_limit = 100;

// and you want this value to be accessed from everywhere, even inside
// functions, but you have no need for it to be in a session variable.
// So put it in $GLOBALS instead
$GLOBALS['credit_limit'] = 100;

// better than (although this works too)
// $_POST['credit_limit'] = 100;

function canbuy($price) {
if ($GLOBALS['credit_limit'] < $price) return false;
else return true;
}
?>

[color=blue]
> But that does not save the value when the page is refreshed, (the same page
> is refreshed).[/color]

Right! Only $_SESSION is guaranteed (*) to keep its value between accesses.

(*) If properly maintained
--
--= my mail box only accepts =--
--= Content-Type: text/plain =--
--= Size below 10001 bytes =--

[Rudi Ahlers]

Re: Wondering about cookie and their pitfalls.

All this about cookies not being reliable, and quite often paranoid users
have cookies turned off altogether, how can one then remember a user logon,
if I only use sessions? The server default expire is set to 3 hours. so for
that 3 hours, whenever a user returns to my site, my site will remember
which page was on last, and that is logged in. How can I make my site
remember the user forever (or until they format / etc? )

--

Kind Regards
Rudi Ahlers
+27 (82) 926 1689

For as he thinks in his heart, so he is. ... (Proverbs 23:7)

[Rudi Ahlers]

Re: Wondering about cookie and their pitfalls.



--

Kind Regards
Rudi Ahlers
+27 (82) 926 1689

For as he thinks in his heart, so he is. ... (Proverbs 23:7)
"Pedro Graca" <hexkid@hotpop. com> wrote in message
news:c0vses$1c5 olm$1@ID-203069.news.uni-berlin.de...[color=blue]
> ["Followup-To:" header set to comp.lang.php.]
> Sims wrote:[color=green]
> > I tried
> > $HTTP_GET_VARS['foo'] = $foo;
> > $HTTP_POST_VARS['foo']= $foo;[/color]
>
> $_GET and $_POST are arrays that behave just like any other variable in
> PHP (except that they get initialized by values the browser sent to the
> server). After the script starts, you can do whatever you want with
> them; but I like to keep $_POST with /only/ the data POSTed to the
> server and $_GET with /only/ the data in the URL -- the same goes for
> almost all other super global variables ($_FILES, $_COOKIE, $_SERVER,
> $_ENV, and $_REQUEST). $_SESSION is a case apart because it's the only
> one that keeps its value between accesses (as long as sessions are
> working and you don't forget to session_start() in all pages that use it).
>
> If you want a super global and do not want it saved between sessions,
> put it in the previously unmentioned superglobal -- $GLOBALS.
> For example:
>
> <?php
> $credit_limit = 100;
>
> // and you want this value to be accessed from everywhere, even inside
> // functions, but you have no need for it to be in a session variable.
> // So put it in $GLOBALS instead
> $GLOBALS['credit_limit'] = 100;
>
> // better than (although this works too)
> // $_POST['credit_limit'] = 100;
>
> function canbuy($price) {
> if ($GLOBALS['credit_limit'] < $price) return false;
> else return true;
> }
> ?>
>
>[color=green]
> > But that does not save the value when the page is refreshed, (the same[/color][/color]
page[color=blue][color=green]
> > is refreshed).[/color]
>
> Right! Only $_SESSION is guaranteed (*) to keep its value between[/color]
accesses.[color=blue]
>
> (*) If properly maintained
> --
> --= my mail box only accepts =--
> --= Content-Type: text/plain =--
> --= Size below 10001 bytes =--[/color]

[Brian Evans]

Re: Wondering about cookie and their pitfalls.

Sims wrote:[color=blue][color=green]
>>2) If the site has some other parts to the site that are separate from
>>the forum, the forum won't mess with these other sections
>>3) phpBB uses a really tight (perhaps even paranoid) control on the
>>session, doing things like IP checks.[/color]
>
>
> I am not sure i really follow you. I am not quite sure i understand point 2
> and 3.[/color]

For point 2, think of a site that has an online store. Now this site
will use sessions as well, and in order to not have the store sessions
mess with the forum sessions, phpBB uses custom sessions.

For point 3, one of the problems with a basic implementation of the
default PHP sessions is the problem of session hijacking, where if the
session ID were to fall into the hands of someone else, you have to be
very careful to make sure the other person doesn't take over the
session. By doing an IP check, if the IP and the session ID don't match
up, phpBB realizes something is up. This however messes with people on
rotating proxies (like AOL users, as well as a few other ISPs) but phpBB
is so strict on who can use sessions, they used custom code. Now you can
be just as strict with the default PHP session code as well, with a
little tweaking.

[color=blue]
> You said something about my own session method, would you have some code for
> it.[/color]

I was saying that if you didn't want to code your own session methods
you should use the PHP ones. PHP 4.x takes out all the hard work of this
so you don't have to worry about it.

[Pedro Graca]

Re: Wondering about cookie and their pitfalls.

Rudi Ahlers wrote:[color=blue]
> For as he thinks in his heart, so he is. ... (Proverbs 23:7)
> "Pedro Graca" <hexkid@hotpop. com> wrote in message
> news:c0vses$1c5 olm$1@ID-203069.news.uni-berlin.de...[color=green]
>> <?php
>> $credit_limit = 100;
>>
>> // and you want this value to be accessed from everywhere, even inside
>> // functions, but you have no need for it to be in a session variable.
>> // So put it in $GLOBALS instead
>> $GLOBALS['credit_limit'] = 100;[/color][/color]

As I reviewed this, I realized that, in a global scope, these two
declarations are *exactly* alike.

But, if you intend to use a variable globally in functions, the second
one makes that much more visible.
--
--= my mail box only accepts =--
--= Content-Type: text/plain =--
--= Size below 10001 bytes =--