Question

I am trying to setup a session management with cookies in PHP.
My code is as follows:

  if(empty($_COOKIE )) {
    setcookie('session_id', md5(uniqid()), time()+(EXPIRE CONSTANT));
  }
  $session_id = isset($_COOKIE['session_id']) ? $_COOKIE['session_id'] : 0;

I will then check session_id for 0 and print an error message if cookies are disabled.
This works fine if cookies are really disabled.

The problem is, if a user clears his history the first time he visits
the site he will get the error message even if cookies are enabled.

Anyone have any clues about this ?
Thank you in advance

Answer 1

When you do the setcookie call, the cookies will be sent when the header is output to the browser. This means the cookie won’t be available until the next page load (when the client sends the cookie back to the server). This is mentioned in the php manual for setcookie http://php.net/manual/en/function.setcookie.php:

setcookie() defines a cookie to be sent along with the rest of the HTTP headers. Like other headers, cookies must be sent before any output from your script (this is a protocol restriction). This requires that you place calls to this function prior to any output, including and tags as well as any whitespace.

Once the cookies have been set, they can be accessed on the next page load with the $_COOKIE or $HTTP_COOKIE_VARS arrays. Note, superglobals such as $_COOKIE became available in PHP 4.1.0. Cookie values also exist in $_REQUEST.

You won’t be able to determine if cookies are enabled/disabled until the page has reloaded (from php). I think you’ll have to do this check with javascript, or to stay in php do a redirect after setting the cookie for the first time, something like:

    if(empty($_COOKIE)) {
            if (isset($_GET['cookieset'])) {
                    // do error message, cookie should be set
            }
            setcookie('session_id', md5(uniqid()), time()+(EXPIRE CONSTANT));
            header('location: http://mysite.com/index.php?cookieset=1');
            exit;
    }
    $session_id = isset($_COOKIE['session_id']) ? $_COOKIE['session_id'] : 0;