超越PHP PHP动态 | 经典文章 | CLASS | 相关下载 | 常见问题 | FORUM | WIKI | 在线手册
Site search:    
<用 PHP 进行 HTTP 认证Dealing with XForms>
Last updated: Fri, 22 Jun 2007

章 34. Cookies

PHP 完全地支持 HTTP Cookies。Cookie 是一种在远程浏览器端储存数据并以此来跟踪和识别用户的机制。您可以使用 setcookie() 函数来设置 Cookie。Cookie 是 HTTP 头的一部分,因此 setcookie() 函数必须在其它信息被输出到浏览器前调用,这和对 header() 函数的限制是类似的。您可以使用输出缓冲函数来延迟脚本的输出,直到按照您的需要设置好了所有的 cookies 或者其它 HTTP 头信息。

任何从客户端发送给您的 cookies 将会像 GET 和 POST 数据一样被自动的转换为 PHP 变量,该过程受 register_globalsvariables_order 两个设置变量的影响。如果您希望对一个 cookie 变量设置多个值,则需在 cookie 的名称后加 [] 符号。

在 PHP 4.1.0 及更高版本,自动全局变量数组 $_COOKIE 将总是包含所有总客户端发来的 cookies 数据。在老版本的 PHP 中,当 track_vars 设置变量打开时(此设置自 PHP 4.0.3 后总是打开的),系统为 cookies 设置的数组变量是 $HTTP_COOKIE_VARS

关于更多细节以及有关浏览器问题的注意事项,请参阅 setcookie() 函数。




add a note add a note User Contributed Notes
Cookies
myfirstname at braincell dot cx
24-Sep-2003 11:47
[Editor's note: Wilson's comment has been deleted since it didn't contain much useful information, but this note is preserved although its reference is lost]

Just a general comment on Wilton's code snippet: It's generally considered very bad practice to store usernames and/or passwords in cookies, whether or not they're obsfucated.  Many spyware programs make a point of stealing cookie contents.

A much better solution would be to either use the PHP built in session handler or create something similar using your own cookie-based session ID.  This session ID could be tied to the source IP address or can be timed out as required but since the ID can be expired separately from the authentication criteria the authentication itself is not compromised.

Stuart Livings

<用 PHP 进行 HTTP 认证Dealing with XForms>
 Last updated: Fri, 22 Jun 2007
view source | feedback | send page | sitemap | aboutus   
Copyright ® 2002-2003 PHPE.NET. All rights reserved
Last updated:2002-11-22