PHP Tutorials - Tutorial Addendum - Using Accolade

(Continued from antecedent part...)

    

I clicked the brace button on the IE window, I got:

    

 

    
Cookies added by the server:

    
   Cookie_2: My cookie value

    
Cookies accustomed by the server:

    
   Cookie_1 = My cookie value

    

What happened actuality was that if I opened the page the first time, the server

    

received no cookie from the browser s request. But my page added one cookie

    

named as "Cookie_1" to the response.

    

When I clicked the brace button, the browser beatific my cookie aback to

    

the server in the request. Then my page added addition cookie called as

    

"Cookie_2" in the response.

    

If I accumulate beat the brace button, added and added accolade would be added

    

to the appeal and response.

    

But there is a limit. The browser will alone yield up to 20 accolade from one Web server.

    

Output Ascendancy Functions

    

As you can see from setcookie() definition, the PHP engine provides no absorber for the HTTP acknowledgment body.

    

That agency as anon the PHP Software starts to forward achievement to the HTTP acknowledgment body, the HTTP attack block

    

will be finalized, and no accustomed to change.

    

But this absence behavior can be adapted by calling achievement ascendancy functions:

    

    
• setcookie() haveto be alleged afore any achievement to the HTTP response. The capital cause is that
  
      

  PHP is not buffering the HTTP response. But you can adapt this behavior by using ob_*() functions.
  
      



    
• ob_start() - A congenital action that turns on achievement buffering.
  
      



    
• flush() - A congenital action that flushes out the capacity of the achievement absorber to the HTTP acknowledgment body.
  
      



    

Of course, absence behavior can aswell be adapted by the agreement file, php.ini. Accessible php.ini and set the afterward

    

line:

    

 

    
output_buffering = 4096

    

The aloft agreement band tells the PHP engine to about-face on achievement buffering, and set the absorber admeasurement to 4096 bytes.

    

Once "output_buffering" is angry on, you don t accept to alarm ob_start() in your scripts.

    

To analysis the PHP engine absence behavior, I adapted CookieTest.php into CookieOutputBuffer.php:

    

 

    
<?php #CookieOutputBuffer.php

    
# Absorb (c) 2005 by Dr.  Yang, http://www.yang.com/

    
#

    
   print("<pre>

");

    
   print("Adding accolade by the server:

");

    
   $numCookies = count( array_keys($_COOKIE) );

    
   $numCookies++;

    
   $cookieName = "Cookie_$numCookies";

    
   $cookieValue = "My cookie value";

    
   print("   $cookieName: $cookieValue

");

    
   setcookie($cookieName, $cookieValue);

    
   print("

Cookies accustomed by the server:

");

    
   foreach ($_COOKIE as $k => $v) {

    
      book "   $k = $v

";

    
   }

    
   

    
   book "</pre>

";

    
?>

    

I then opened php.ini and set the afterward line:

    

 

    
output_buffering = 0

    

Running IE on CookieOutputBuffer.php gave me this:

    

 

    
Adding accolade by the server:

    
   Cookie_2: My cookie value

    
Cookies accustomed by the server:

    
   User =  Yang

    
PHP Warning: Cannot adapt attack advice - headers already 

    
sent by (output started at ...CookieOutputBuffer.php:4) ...

    

Now I absolutely beblieve that PHP engine s absence behavior is no achievement buffering. Create abiding to change

    

"output_buffering" aback to 4096 afore continuing to the next test.

    

(Continued on next part...)