Member Avatar for MDGM

hii all,

I have a 5 star rating system which writes a cookie as the following when the user rates a product:

$pid = $_GET['pid']; //product ID (primary key)
$ratepostpone = 300; //5 minutes until it expires and the user can rate again
$cookieroot = '.mysite.com'; //my website's directory including sub domains

setcookie('ms-'.$pid,'ms-'.$pid,time()+$ratepospone,'/',$cookieroot);

However I'm finding that when I vote on two products within 5 minutes of each other it is overwritting the cookie. When I check what cookies I have saved on my computer it lists one cookie (ms-483243) and then if I rate another product and re-check my cookies it has deleted ms-483243 and replaced it with (ms-218572)

any ideas why?

Thanks in advance,

Max

  • 2 Contributors
  • 4 Replies
  • 113 Views
  • 18 Hours Discussion Span
  • Latest Post Latest Post by MDGM

Dani AI

Generated

Brief summary and quick checks (adds to and )

Two immediate things to verify before changing approach: look at the actual Set-Cookie headers your script sends (use the browser DevTools Network tab or curl -I) and inspect the cookie attributes (Name, Domain, Path, Expires). A common silent bug in the snippet above is a misspelled expiry variable which makes the cookie expire immediately — that will look like the old cookie disappearing when you set a new one. Also confirm Domain/Path are what you expect; mismatches cause apparent “missing” cookies.

A safer approach than one cookie per product
Storing one cookie that holds a list of rated product IDs is simpler and avoids hitting per-domain cookie limits. Use a structured format (JSON) so checks are exact and you don’t get substring false-positives (e.g., id 123 matching 2123). Decode the cookie to an array, check membership, append if needed, re-encode and reset the cookie with a proper expiry and flags (Secure/HttpOnly when appropriate).

Example pattern (conceptual):

# read JSON array from cookie, decode to array
# if pid not in array, append and set cookie again (with expiry and HttpOnly)

Notes, pitfalls and best practices

  • Avoid ereg/eregi (deprecated). Use strict checks (in_array, strpos with delimiters, or preg_match with preg_quote).
  • Browsers impose practical limits (per-cookie size ~4KB and a limited number of cookies per domain). See the cookie spec and practical notes: RFC 6265 and MDN Cookies overview.
  • For anything security-sensitive (preventing repeat voting), do not rely solely on client-side cookies — pair with server-side tracking (session, DB) or signed cookies to prevent tampering.

Recommended Answers

All 4 Replies

Member Avatar for jt1

I think it has to do with your cookie name:

'ms-'.$pid

This is going to be different for each product that is rated, thus creating another cookie.

Try using one name for the cookie and set the $pid in the cookie value.

$new_value = 'ms-'.$pid;
if ($_COOKIE['RATED_PRODUCTS'] != '') //append product id : is the separator
    $new_value = $_COOKIE['RATED_PRODUCTS'].':'.$new_value;
setcookie('RATED_PRODUCTS',$new_value,time()+$ratepospone,'/',$cookieroot);
Member Avatar for MDGM

so each PID would be seperated by a ':' and to check if the user has already rated it I would have to search for the PID within the value of the cookie?

How long can the cookie value be anyway?

Thanks for the help by the way.

Max

Member Avatar for jt1

Yes that is correct, you then could do something along the lines of:

if (ereg(':', $_COOKIE['RATED_PRODUCTS']))
{
	// We have more than 1 product id
	$pids = explode(':', $_COOKIE['RATED_PRODUCTS']);
	
	for ($i = 0; $i < count($pids); $i++)
	{
		// Do something with stored product ids
		echo($pids[$i]);
	}
}
else
{
	// We have only 1 product id
	echo($_COOKIE['RATED_PRODUCTS']);
}

I think there is no limit to the length of the cookie value, not 100% sure on this one.

Member Avatar for MDGM

okay thanks. I only need to check to see if a single PID is saved inside the cookie so will this work:

if (eregi($pid, $_COOKIE['RATED_PRODUCTS']))
{
	echo 'you have already rated';
}
else
{
	echo $ratingsystem;
}

To make the PID i'm using rand(0,99999); so it is unlikely that one PID will be found inside another one... but is there a possibility that it might?

Max

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.