Question

Ok, so I want to store some user options in $_COOKIES after form submit.
My code is this:

    $reason=array_values(array_filter($_POST['reasontext']));
    $str=implode('|',$reason);

    if(!isset($_COOKIE['reason'])){
         setcookie('reason',$str,time()+86400*30*12);
    }elseif(isset($_COOKIE['reason2'])){
         setcookie("reason", "", time()-3600);
         setcookie("reason",$_COOKIE['reason2'],time()+86400*30*12);
         setcookie('reason2', "", time()-3600);
    }else{
         setcookie("reason", "", time()-3600);
         setcookie('reason',$str,time()+86400*30*12);
    }

Basically, for an array of let`s say: ‘1’=>’Test1′, ‘2’=>’Test2′, ‘3’=>’Test3′

The select tool should have had 3 options different for each user, depending on what the user submited as $_POST[‘reasontext’].

Well this isn`t so, each user can clearly see what the other one has submited and stored in the cookie which should have been Personal.

What I want is that each cookie ‘reason’ to be stored on each users computer and from there to load the different user-customised options.

Any tips?

Thanks in advance for the heads up 🙂

Answer 1

If you want cookies to be private, you should:

1. Make your cookie consist of a unique ID and a signature to verify the ID.
2. Mark the cookie as secure, so it can only be transmitted via HTTPS.
3. Check the signature to validate the ID before using it.
4. Use the ID to lookup the data in your database.
5. Periodically reissue the ID and signing token, so it is hard to steal/forge.

If you want data to be stored just on the user’s computer and not be transmitted to the server, then one of the various Storage interfaces would be good for that (localStorage, sessionStorage, etc.). However, you would set that in JavaScript rather than as a result of a POST, and the disadvantage to that mechanism is that the data would be specific to the browser on which it was set, whereas with the cookie solution, you could potentially restore the user’s settings when the user logs in.