使用 header(“Set-cookie”) 与 setcookie() 函数设置 cookie

Question

I'm refactoring some code and found something I've never seen. the function is used for user to set cookie when user logs in:

  function setUserCookie($name, $value) {
     $date = date("D, d M Y H:i:s",strtotime('1 January 2015')) . 'GMT';
     header("Set-Cookie: {$name}={$value}; EXPIRES{$date};");
  }

now that I've been assigned to refactor code I'm planning to use setcookie function which essentially does same thing according to php.net.

My question is: is there any difference between two and which one should I use?

NOTE: this code was written long time ago so I'm assuming that at that time setcookie didnt exist?

Answer 1

There's no good reason not to use setcookie. The above code doesn't properly encode names and values, so that's at least one major benefit to refactoring.

Answer 2

The difference between the two functions is that header() is the general function for setting HTTP headers while setcookie() is specifically meant to set the Set-Cookie header.

header() therefore takes a string containing the complete header, while setcookie() takes several cookie-specific arguments and then creates the Set-Cookie header from them.

Answer 3

Here's a use case in which you can't use setcookie

• you run a website on PHP<7.3
• you have to set 'SameSite' cookie attribute

You can achieve that by exploiting a bug in setcookie, but I wouldn't rely on a bug as it gets fixed over time: setcookie('samesite-test', '1', 0, '/; samesite=strict');

Or you can use PHP header function: header("Set-Cookie: samesite-test=1; expires=0; path=/; samesite=Strict");

Note that secure option is required when setting samesite attribute

Answer 4

One big difference is, that setcookie always sets host_only=false and there is nothing you can do about it.

So if you have to set host_only=true for whatever reasons you have to use the header method. As far as I know.