Okay, I am not getting any response with my original wordy wordness...
Can you execute script before setting cookies, or must it be the absolute first thing?
Can you set cookies, and is it practical, with $_POST or $_GET
if not practical...or secure...what can I do to make sure my cookies are set securely (at least more secure than the method I am trying) without utilizing SSL
I appreciate the help.
Matt
Setting cookies doesn't have to be the beginning of the script -- it just has to happen before you actually output any HTML (or http headers like a redirect).
Yes, it's very practical to read and set cookies along with $_POST and $_GET. You set cookies with the setcookie function in PHP, and read them from $_COOKIE.
In terms of security, you just need to think about a few things. For example, the user can see and modify what's contained in the cookies. Anyone upstream on the network could potentially do the same. The key is to not store data in the cookie that is supposed to be "secure".
Use a tool like Firebug in Firefox and look at the Net tab, then expand the details section of each request to look at the request and response headers. This should help you get a better grip on the topic.
Cookies are just arbitrary text values send in the response header before the actual website is send. They tell the browser to save them somewhere and send them back to the originating domain in the request header for each subsequent request.
That means, they can be send together with any response header. POST is a request type and hence has nothing to do with setting cookies. The browser can send cookies to the server together with a POST request.
You can execute any script before setting cookies. But, since cookies need to be send in the header, you can't send them after you have started outputting the webpage.
There's only one way to set cookies, in the response header. The only secure way to set a cookie is to send it with the secure flag over SSL, which only means the cookie should not be send back to the server over non-SSL connections. That's it. Hence, think carefully about what information to put into cookies.
Sessions can solve this problem. A session just sends a meaningless token as cookie and uses this to retrieve data stored on the server.