PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

Understanding Basic Session Functionality
511
when the user visits the next page in your site (or reloads the current page), you will
have access to the cookie via $_COOKIE[‘mycookie’].
You can delete a cookie by calling setcookie() again with the same cookie name
and an expiry time in the past.You can also set a cookie manually via the header()
function and the cookie syntax given previously. One tip is that cookie headers must be
sent before any other headers; otherwise, they will not work. (This is a cookie limitation
rather than a PHP limitation.)
Using Cookies with Sessions
Cookies have some associated problems: Some browsers do not accept cookies, and some
users might have disabled cookies in their browsers.This is one of the reasons PHP sessions
use a dual cookie/URL method. (We discuss this method shortly.)
When you are using PHP sessions, you do not have to manually set cookies.The session
functions take care of this task for you.
You can use the function session_get_cookie_params() to see the contents of the
cookie set by session control. It returns an array containing the elements lifetime,
path, domain, and secure.
You can also use
session_set_cookie_params($lifetime, $path, $domain [, $secure]);
to set the session cookie parameters.
If you want to read more about cookies, you can consult the cookie specification on
Netscape’s site: http://wp.netscape.com/newsref/std/cookie_spec.html
(You can ignore the fact that this document calls itself a “preliminary specification”; it’s
been that way since 1995 and is as close to a standard as a document could be without
actually being called a standard!)
Storing the Session ID
PHP uses cookies by default with sessions. If possible, a cookie will be set to store the
session ID.
The other method it can use is adding the session ID to the URL.You can set this to
happen automatically if you set the session.use_trans_sid directive in the php.ini
file. It is off by default.You should use caution when turning this directive on as it
increases your site’s security risks. If this is set to on, a user can email the URL that contains
the session ID to another person, the URL could be stored in a publically accessible
computer, or it may be available in the history or bookmarks of a browser on a publically
accessible computer.