Cookie值是数组是否合法？

Question

I always assumed that cookies may only hold strings, but the way PHP handles cookies, it is also possible to store an array in a cookie (and I'm not talking about serialized array, but a native array). All you need to do is this:

setcookie('a[1]', 'a');
setcookie('a[2]', 'b');
var_dump($_COOKIE);

The above will produce the following (remember to execute it twice):

array(1) {
  ["a"]=>
  array(2) {
    [1]=>
    string(1) "a"
    [2]=>
    string(1) "b"
  }
}

What's going on here? Clearly we managed to store an array to a cookie, which is supposed to hold strings only. Is this a bug?

Answer 1

It is certainly not a bug. As a matter of fact it is documented in PHP Documentation

You may also set array cookies by using array notation in the cookie name. This has the effect of setting as many cookies as you have array elements, but when the cookie is received by your script, the values are all placed in an array with the cookie's name:

Answer 2

A cookie value can only be a string.

When PHP parses the cookies into $_COOKIE , certain naming conventions (ie cookies with names that end in [] or [something] ) will cause it to represent them as an array.