Re: [PHP] Saving cookies
[email protected] (AllenJB) Sun, 12 Apr 2026 08:42:24 +0100
| Newsgroups | php.general |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --------------mqs7eCWpOFhJkBrl77xRfmrK Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit On 12/04/2026 01:49, [email protected] wrote: > i understand that if you set a cookie & it fails, it fails silently.. > (no errors) > > Is there a way to force an error if it fails ? - Fog horn, Siren > blast, a cannon - "here is an error" In cases where PHP knows setcookie() has failed it will either return false (and a warning / notice will be issued, which can be caught with a custom error handler - see set_error_handler()) or it will throw a ValueError (which can be caught with a try/catch, or the uncaught exception handler) Other than headers already being sent, there are very few scenarios where setting a cookie should be able to fail. The most likely cases I can think of involve setting invalid parameters (domain, path, expiry, name, options like http-only, secure, partitioned, etc), or illegal characters in the name / value. PHP checks for most issues with the cookie settings and setcookie() will throw a value error. Illegal characters in the name / value (which will throw a ValueError) can be handled by encoding - PHP will automatically urlencode values unless you use setrawcookie() - or storing the actual value server-side and storing an id in the cookie, as happen with sessions. If the cookie is rejected / discarded by the client-side, there's no way the PHP script that set the cookie can know. The PHP script has already terminated at this point. This scenario is also highly unlikely (assuming default cookie settings, or the code already passed development-time testing) unless the user has chosen to block cookie (with a browser extension). You could possibly add some JS to the page that checks if the cookie has been set, but this does require that the cookie not be marked "http only", which may reduce security, depending on the purpose the cookie. For development-time testing I would rely on the browser dev tools - is the Set-Cookie header present in the response where the cookie is supposed to be set? Does the cookie appear in the browsers cookie viewer? Is the Cookie header present in the following request? In the case of sessions (using the default session handler), in addition to the cookie not being set, the most likely cause of failure is server-side issues - most likely filesystem related, where either the ownership / permissions of `session.save_path` are incorrect, or the disk is full. The former case should be taken care of by deployment, and the latter by server-level monitoring and alerting. One common cause of unexpected output is using `?>` close tags on PHP files with no output (which are then followed by output such as whitespace). As a general rule, `?>` should only be used when output follows it / in view templates. There's no need to use `?>` on every PHP file. --------------mqs7eCWpOFhJkBrl77xRfmrK Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body> <p><br> </p> <div class="moz-cite-prefix">On 12/04/2026 01:49, <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> wrote:<br> </div> <blockquote type="cite" cite="mid:CACOt7mH6jU9iD8g2ENJkWzbC=0=y4S6wY9tQ+XtTBVeg6X=t3A@mail.gmail.com"> <pre wrap="" class="moz-quote-pre">i understand that if you set a cookie & it fails, it fails silently.. (no errors) Is there a way to force an error if it fails ? - Fog horn, Siren blast, a cannon - "here is an error"</pre> </blockquote> <p>In cases where PHP knows setcookie() has failed it will either return false (and a warning / notice will be issued, which can be caught with a custom error handler - see set_error_handler()) or it will throw a ValueError (which can be caught with a try/catch, or the uncaught exception handler)</p> <p>O<span style="white-space: normal">ther than headers already being sent, there are very few scenarios where setting a cookie should be able to fail. </span>The most likely cases I can think of involve setting invalid parameters (domain, path, expiry, name, options like http-only, secure, partitioned, etc), or illegal characters in the name / value.</p> <p>PHP checks for most issues with the cookie settings and setcookie() will throw a value error.</p> <p>Illegal characters in the name / value (which will throw a ValueError) can be handled by encoding - PHP will automatically urlencode values unless you use setrawcookie() - or storing the actual value server-side and storing an id in the cookie, as happen with sessions.</p> <p>If the cookie is rejected / discarded by the client-side, there's no way the PHP script that set the cookie can know. The PHP script has already terminated at this point. This scenario is also highly unlikely (assuming default cookie settings, or the code already passed development-time testing) unless the user has chosen to block cookie (with a browser extension).</p> <p>You could possibly add some JS to the page that checks if the cookie has been set, but this does require that the cookie not be marked "http only", which may reduce security, depending on the purpose the cookie.</p> <p>For development-time testing I would rely on the browser dev tools - is the Set-Cookie header present in the response where the cookie is supposed to be set? Does the cookie appear in the browsers cookie viewer? Is the Cookie header present in the following request?</p> <p>In the case of sessions (using the default session handler), in addition to the cookie not being set, the most likely cause of failure is server-side issues - most likely filesystem related, where either the ownership / permissions of `session.save_path` are incorrect, or the disk is full. The former case should be taken care of by deployment, and the latter by server-level monitoring and alerting.</p> <p>One common cause of unexpected output is using `?>` close tags on PHP files with no output (which are then followed by output such as whitespace). As a general rule, `?>` should only be used when output follows it / in view templates. There's no need to use `?>` on every PHP file.</p> </body> </html> --------------mqs7eCWpOFhJkBrl77xRfmrK--