Setting Cookies

setcookie() tells the browser to store a cookie. The modern way uses an options array.

1
2
3
4
5
6
7
8

<?php
setcookie("theme", "dark", [
    "expires" => time() + 60 * 60 * 24 * 30,   // 30 days
    "path" => "/",
    "secure" => true,       // HTTPS only
    "httponly" => true,     // hidden from JavaScript
    "samesite" => "Lax",
]);

Call it before any output

Cookies are sent in the HTTP headers, so setcookie() must run before any output, just like session_start() and header(). Otherwise PHP warns “headers already sent”, and the cookie is not sent.

The options

The value is not in $_COOKIE yet

The cookie goes to the browser with the response. PHP fills $_COOKIE from the request. So the new cookie appears in $_COOKIE only on the next page load.

1
2
3
4

<?php
setcookie("seen", "yes", ["path" => "/"]);

var_dump(isset($_COOKIE["seen"]));   // false on the first visit

If you need the value now, store it in a variable too.

Time helpers

1
2
3
4

<?php
$expires = time() + 60 * 60 * 24 * 7;   // 7 days from now

echo round(($expires - time()) / 86400) . " days";

1

7 days

Encode values

setcookie() URL-encodes the value for you. setrawcookie() does not, so avoid it unless you know why you need it.

Choose the right SameSite value

• Lax is a good default: cookies are sent when the user clicks a link to your site, but not on most cross-site requests.
• Strict is stronger, but a cookie is not sent when someone arrives from another site by a link. A user opening your site from an email can appear logged out.
• None sends the cookie in all cross-site requests. It requires secure => true.

A preference cookie with validation

1
2
3
4
5
6
7
8
9
10

<?php
function themeFromCookie(array $cookies): string
{
    $allowed = ["light", "dark"];

    return in_array($cookies["theme"] ?? "", $allowed, true) ? $cookies["theme"] : "light";
}

echo themeFromCookie(["theme" => "dark"]) . " ";
echo themeFromCookie(["theme" => "<script>"]);

1

dark light