setcookie

Setcookie is a PHP function used to send a cookie from the server to the client. It uses the HTTP Set-Cookie header to store data on the user’s device, and the cookie value is returned by the browser with subsequent requests in the Cookie header. The function returns true on success and false on failure.

Signature and options: The traditional signature is setcookie(string $name, string $value = "", int $expires = 0, string $path = "", string $domain = "", bool $secure = false, bool $httponly = false): bool. In PHP 7.3 and later, a second form accepts an array of options: setcookie(string $name, string $value = "", array $options = []): bool. The options array may include expires (Unix timestamp), path, domain, secure, httponly, and samesite.

Usage: Example: setcookie("user", "alice", time() + 3600, "/"); This creates a cookie named user that expires in one hour and is available for the entire site. To delete a cookie, set its expiration in the past, e.g., setcookie("user", "", time() - 3600, "/");.

Lifetime and scope: The expires parameter sets the cookie’s lifetime; 0 means a session cookie. Path and domain restrict where the cookie is sent. Secure requires HTTPS; HttpOnly prevents access from JavaScript. SameSite helps mitigate CSRF by controlling cross-site usage.

Notes: Cookies are stored on the client and sent with each request; PHP can read them via $_COOKIE. setcookie only sets headers; it does not modify server-side storage. Use caution with sensitive data and consider signing or encrypting values.

Alternatives: setrawcookie sends the same header without URL-encoding the value.