|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #32827 New cookie behaviour is breaking backward compatibility
Submitted: 2005-04-25 23:03 UTC Modified: 2005-04-25 23:21 UTC
From: Assigned:
Status: Closed Package: *General Issues
PHP Version: 4CVS-2005-04-25 (stable) OS: all
Private report: No CVE-ID: None
 [2005-04-25 23:03 UTC]
Recent changes in cookie handling breaks backward compatibility.

The netscape cookie specification says about commas in Set-Cookie header:

If there is a need to place such data in the name or value, some encoding method such as URL style %XX encoding is recommended, though no encoding is defined or required.


Additionally this limitation only covers name=value in Set-Cookie and not Cookie name=opaque_strings.

PHP's Set-Cookie does not allow sending plain commas as Cookie, but that does not change the fact, that anyone can set a Cookie via Java Script with a plain comma in it or use another script language that runs on the same server and is part of the application. Browsers happily send them in plain back.

Lots of sites, especially those with ad banners have plain commas in there cookies. It is not longer possible for PHP script on those servers to handle these cookies.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2005-04-25 23:21 UTC]
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
Thank you for the report, and for helping us make PHP better.

PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Tue Nov 30 10:03:35 2021 UTC