Skip to main content

Echo Cookie Setting

Introduction​

When developing web applications, managing user states and preferences is a crucial aspect. One of the most common ways to achieve this is through cookies - small pieces of data stored in the user's browser. In this lesson, we'll explore how to set cookies as part of an HTTP response using echo statements, a technique we call "Echo Cookie Setting."

This approach allows you to create, modify, and delete cookies directly through your server-side code, providing a seamless way to maintain user sessions and store small amounts of user-specific data.

What Are Cookies?​

Cookies are small text files that websites store on a user's browser. They typically contain:

  • Key-value pairs of information
  • Expiration dates
  • Domain restrictions
  • Path specifications
  • Security flags

Before we dive into setting cookies with echo statements, it's important to understand how cookies work in HTTP.

HTTP cookies are set using the Set-Cookie header in the HTTP response. A typical cookie might look like this:

Set-Cookie: username=john_doe; expires=Thu, 31 Dec 2023 23:59:59 GMT; path=/; domain=example.com; secure; httpOnly

This header tells the browser to store a cookie named "username" with the value "john_doe" that will expire at the end of 2023, applies to all paths on the example.com domain, and includes security flags.

Setting Cookies with Echo in PHP​

In PHP, you can use the setcookie() function combined with echo statements for debugging or confirmation:

php
<?php
// Set a simple cookie
setcookie("user", "beginner_programmer", time() + 3600, "/");

// Echo confirmation
echo "Cookie 'user' has been set!";
?>

Output:

Cookie 'user' has been set!

Setting Multiple Properties​

Let's create a more complex cookie with additional properties:

php
<?php
// Set cookie with multiple properties
setcookie("preferences", json_encode([
    "theme" => "dark",
    "fontSize" => "medium"
]), time() + (86400 * 30), "/", "", false, true);

echo "User preferences cookie has been set for 30 days!";
?>

Output:

User preferences cookie has been set for 30 days!

Manual Header Echo​

For more control, you can directly echo the HTTP headers (though this is less common and not recommended for beginners):

php
<?php
// Must be called before any output
header("Set-Cookie: manual_cookie=custom_value; Max-Age=3600; Path=/; SameSite=Strict");
echo "Manually set cookie using header!";
?>

Output:

Manually set cookie using header!

While our primary focus is server-side cookie setting, it's worth noting that JavaScript can also set cookies via the document.cookie property:

javascript
// Set a cookie using JavaScript
document.cookie = "jsPreference=enabled; max-age=3600; path=/";
console.log("Cookie set via JavaScript");

Output in console:

Cookie set via JavaScript

Reading Cookies Back​

After setting a cookie, you'll often want to read it back. In PHP:

php
<?php
// First set a cookie
setcookie("favorite_language", "PHP", time() + 3600, "/");
echo "Cookie set.<br>";

// On subsequent page loads, you can read it
if(isset($_COOKIE["favorite_language"])) {
    echo "Your favorite programming language is: " . $_COOKIE["favorite_language"];
} else {
    echo "Favorite language cookie not found.";
}
?>

Potential output on second page load:

Your favorite programming language is: PHP

Practical Examples​

User Authentication Reminder​

php
<?php
// User just logged in
$username = "student123";

// Set a "remember me" cookie that lasts for 30 days
setcookie("remember_user", $username, time() + (86400 * 30), "/");

echo "Welcome back, $username! Your login will be remembered for 30 days.";
?>

Theme Preference​

php
<?php
$selected_theme = $_POST["theme"] ?? "light";

// Save the theme preference as a cookie
setcookie("user_theme", $selected_theme, time() + (86400 * 365), "/");

echo "Theme preference saved as '$selected_theme'! Your settings will be applied on all pages.";
?>

To delete a cookie, you set it with an expiration time in the past:

php
<?php
// Set cookie
setcookie("temporary", "will_be_deleted_soon", time() + 60, "/");
echo "Temporary cookie set.<br>";

// Delete cookie
setcookie("temporary", "", time() - 3600, "/");
echo "Temporary cookie deleted.";
?>

Security Considerations​

When setting cookies via echo mechanisms, always consider these security practices:

  1. Use HTTPOnly Flag: Prevents JavaScript from accessing the cookie, reducing XSS risks

    php
    setcookie("session_id", "abc123", time() + 3600, "/", "", false, true);
    // The final 'true' sets the HTTPOnly flag

  2. Use Secure Flag: Ensures cookies are only sent over HTTPS connections

    php
    setcookie("api_token", "secret_token", time() + 3600, "/", "", true, true);
    // The second-to-last 'true' sets the Secure flag

  3. Set SameSite Attribute: Protects against CSRF attacks

    php
    header("Set-Cookie: csrf_token=random_token; Max-Age=3600; Path=/; SameSite=Strict; HttpOnly");

Sometimes cookies don't work as expected. Here are some debugging techniques:

php
<?php
// Display all cookies for debugging
echo "<pre>Current cookies: ";
print_r($_COOKIE);
echo "</pre>";

// Check if specific cookie exists
if(isset($_COOKIE["user_preference"])) {
    echo "User preference found: " . $_COOKIE["user_preference"];
} else {
    echo "User preference cookie not set. Setting now...";
    setcookie("user_preference", "default", time() + 3600, "/");
}
?>
  1. Headers already sent: Cookie setting must occur before any HTML output
php
<?php
echo "This will cause an error"; // Output before setcookie()
setcookie("test", "value"); // This will fail
?>

Correct approach:

php
<?php
setcookie("test", "value"); // Set cookie first
echo "This is correct"; // Then output HTML
?>
  1. Incorrect path parameter: The cookie won't be available where you expect it
php
<?php
// This cookie is only available in the /account/ directory
setcookie("user", "value", time() + 3600, "/account/");
?>

Summary​

Echo Cookie Setting is a fundamental technique for web developers that combines HTTP cookie headers with server response mechanisms. We've learned:

  • How to set basic cookies using PHP's setcookie() function
  • Methods for confirming cookie setting through echo statements
  • Advanced options for cookie properties like expiration, path, and security flags
  • Practical examples for real-world cookie applications
  • Security best practices to protect cookie data
  • Common errors and how to avoid them

By mastering echo cookie setting, you have gained an essential skill for building stateful web applications that remember user preferences and maintain sessions.

Exercises for Practice​

  1. Create a cookie that remembers a user's name and greets them by name when they return to your site.
  2. Build a theme switcher that uses cookies to store the user's preference (dark/light mode).
  3. Create a "recently viewed items" feature using cookies to store the IDs of the last 5 products a user viewed.
  4. Implement a cookie consent banner that sets a cookie when the user accepts cookies.

Additional Resources​

Remember that while cookies are powerful, they have limitations in size (typically 4KB) and should only store non-sensitive information. For larger data or sensitive information, consider server-side storage solutions with cookie-based references.


If you spot any mistakes on this website, please let me know at [email protected]. I’d greatly appreciate your feedback! :)