setrawcookie
(PHP 5, PHP 7, PHP 8)
setrawcookie — Send a cookie without urlencoding the cookie value
Description
Alternative signature available as of PHP 7.3.0 (not supported with named parameters):
setrawcookie() is exactly the same as
setcookie() except that the cookie value will not be
automatically urlencoded when sent to the browser.
Parameters
For parameter information, see the setcookie()
documentation.
Return Values
Returns true on success or false on failure.
Changelog
| Version |
Description |
| 7.3.0 |
An alternative signature supporting an options
array has been added. This signature supports also setting of the
SameSite cookie attribute.
|
Brian ¶ 19 years ago
Firefox is following the real spec and does not decode '+' to space...in fact it further encodes them to '%2B' to store the cookie. If you read a cookie using javascript and unescape it, all your spaces will be turned to '+'.
To fix this problem, use setrawcookie and rawurlencode:
<?php
setrawcookie('cookie_name', rawurlencode($value), time()+60*60*24*365);
?>
The only change is that spaces will be encoded to '%20' instead of '+' and will now decode properly.
subs at voracity dot org ¶ 18 years ago
setrawcookie() isn't entirely 'raw'. It will check the value for invalid characters, and then disallow the cookie if there are any. These are the invalid characters to keep in mind: ',;<space>\t\r\n013円014円'.
Note that comma, space and tab are three of the invalid characters. IE, Firefox and Opera work fine with these characters, and PHP reads cookies containing them fine as well. However, if you want to use these characters in cookies that you set from php, you need to use header().