Cookies - What are my limitations?

gonsman

I know that the limit is 20 cookies per domain, but what exactly is a "cookie"? I have four cookies total and three of them are arrays. Is each value in the array considered a cookie? Because when I reach a total of 20 values, and then add another, some start to get deleted.

I created a shopping cart using cookies because I wanted to not use the server as much as possible. Each product that I add, requires a value in 3 different cookies: ID (cart_prodid), Quantity (cart_prodqty), and Any Options (cart_prodoption). There is also another cookie for the last item added (cart_lastadded), but this is not an array like the others.

Here is my code:

$t = time()+3600247;
setcookie("cart_prodid[$cartid]", "$cartid", $t, "/new/site/", ".mydomain.com");
setcookie("cart_prodqty[$cartid]", "$qty_new", $t, "/new/site/", ".mydomain.com");
setcookie("cart_prodoption[$cartid]", "$cartoption", $t, "/new/site/", ".mydomain.com");
setcookie("cart_lastadded", "$cartprodtitle", $t, "/new/site/", ".mydomain.com");

I cut and pasted the phpinfo(); right before the next product would be added and start to erase the cookies. Is this a bad way to do a shopping cart?

_COOKIE["cart_prodid"] Array
(
[TS17S] => TS17S
[TS17M] => TS17M
[TS17L] => TS17L
[TS17X] => TS17X
[TS17Y] => TS17Y
[TS17Z] => TS17Z
)

_COOKIE["cart_prodqty"] Array
(
[TS17S] => 1
[TS17M] => 1
[TS17L] => 1
[TS17X] => 1
[TS17Y] => 1
[TS17Z] => 1
)

_COOKIE["cart_prodoption"] Array
(
[TS17S] => 0
[TS17M] => 1
[TS17L] => 1
[TS17X] => 1
[TS17Y] => 1
[TS17Z] => 1
)

_COOKIE["cart_lastadded"] T-shirt

MrAlaska

Each of your cookie arrays would be a separate cookie I am pretty sure. Since you are setting persistent cookies, you should be able to verify that by looking in your cookie folder.

You can store an array inside a single cookie by serializing and unserializing it. If you're not carful, though, it is possible to run into size limits. I believe it is 1 or 2 k per cookie. You could also convert your array to a string and store that in the cookie.

Storing a shopping cart on the cookie would reduce server load, but would increase network load. Network performance is often more vulnerable than server performance. My personal preference is to store the cart in a database.

gonsman

If I use a table to store shopping cart data, what happens to all of the users that add stuff to the the shopping cart and never order anything and don't empty their cart? The table would get quite large after some time. Is there a good way to delete old shopping cart data from the table?

-Sean

MrAlaska

There are several approaches you can take, some of which depend on whether you are requiring users to log in before adding to their cart or not.

One way would be to tie the shopping cart to the session, when the session is no longer active delete the related items from the cart. This assumes you are managing your own sessions, though, to do it using php's $_session management you might need to make the shopping cart items session variables and that might stress out the server more than you want. Of course, doing it this way would not allow returning members to retain active carts, which might not be a good thing.

It would be simple enough to run a cron job to check for old items in the shopping cart table and delete them if they are past a certain age, or emulate that behavior by triggering a clean up check on some other event such as when a new user signs up or something.

I would probably do a combination of the two if you are not requiring users to have an associated user_id to shop. I would aggressively clean up old items that do not have a user_id associated and let the other items live a little longer.

It's all do-able, just a matter of planning to tailor it to your site's needs.

tha_mink

A better approach might be to use sessions AND cookies. You can set a cookie with the php session id and give the session a reasonable expiration date. Since sessions have their own method of garbage collection...you don't have to worry about server clutter as much. Plus...if a user has cookies disabled...your shopping cart will still work as the session id will can get passed through the url.

I have found this article and its offspring very helpful

MrAlaska

Originally posted by tha_mink A better approach might be to use sessions AND cookies. You can set a cookie with the php session id and give the session a reasonable expiration date. Since sessions have their own method of garbage collection...you don't have to worry about server clutter as much.

A 'reasonable' expiration date for $SESSION's would be how long it takes to read a page and go on to the next one. I believe the default is somewhere in the neighborhood of twenty minutes. To make it unduly long would block PHP's cleanup efforts and trash your server's file system as well as hinder $SESSION performance.

A reasonable expiration date for a shopping cart is how many days or weeks do you think it might take a customer to finally spring for that expensive almost authentic widget you have marked up 600% and the customer has had tucked away in their shopping cart with their drooling finger poised over the 'checkout' button.

Originally posted by tha_mink Plus...if a user has cookies disabled...your shopping cart will still work as the session id will can get passed through the url.]

A needed component of maintaining state that PHP takes the work out of, but you can do this through your code without using $_SESSION's if want to manage your own sessions.

Originally posted by tha_mink
I have found this article and its offspring very helpful

From a TECHNICAL standpoint, that is an excellant article. One of the most informative on PHP sessions I have encountered, thank you for posting it.

From a PRACTICAL standpoint, the out-dated examples presented assume globals are enabled and promote sloppy programming. All variables should be declared explicitly through their respective arrays, and for security purposes session_register(), session_is_registered(), should disappear from all code.