Setrawcookie

Setrawcookie is a PHP function that sends a Set-Cookie header with a raw, unencoded value. It is like setcookie but does not URL-encode the value, allowing certain characters to pass through unchanged. This can be useful for storing data that encoding would alter, but it increases the risk of malformed headers if the value contains characters such as semicolons.

Syntax and parameters: setrawcookie(string $name, string $value = "", int $expire = 0, string $path = "", string $domain = "", bool $secure = false, bool $httponly = false): bool. It returns true on success and false on failure. $expire is a Unix timestamp for expiration; 0 means a session cookie. Other parameters control scope and security flags.

Usage example: setrawcookie('prefs', 'lang=en|theme=dark', time() + 3600, '/'); This creates a cookie named prefs for one hour on the whole site. On later requests, $_COOKIE['prefs'] contains the raw value.

Considerations: since the value is not encoded, avoid semicolons and characters that could break the header, and prevent CR or LF to avoid header injection. Cookie size is limited (roughly 4 KB per cookie). For sensitive data, use secure and httpOnly and prefer server-side storage when possible.

Relation to setcookie: setcookie applies URL encoding to the value, while setrawcookie does not. Choose based on whether you need to preserve exact characters and can manage encoding yourself.