<INPUT TYPE=hidden NAME=state VALUE="hidden info to be returned with form">By now, most browsers can handle the hidden type, but understand that some browsers will fail to hide the field (and probably confuse the user). Note that "hidden" doesn't mean "secret"; the user can always click on "view source."
The ugliness of a "hidden" field appearing on a browser that doesn't understand hidden fields can be minimized by setting SIZE=0 for that attribute.
http://mysite.com/cgi-bin/mycgi
But you open the following URL instead:
http://mysite.com/cgi-bin/mycgi/Bob/27
The program "mycgi" will still be executed -- and the environment
variable PATH_INFO will contain the text /Bob/27
. You
can take advantage of this by always outputting URLs that contain
the state information you are trying to keep from one call to the next.
Keep in mind that URLs are limited to 1024 characters; browsers are not required to cope with more than that. If you need more, or dislike long URLs, simply keep the name of a temporary file in the PATH_INFO section of the URL and store information about that session in the temporary file.
For example, your CGI program might output the following to set a cookie. (Note that the Set-Cookie header must appear in its entirety on one line.)
Content-type: text/html Set-Cookie: cookiename=valueofcookie; expires=Saturday, 28-Feb-96 23:59:59 GMT; path=/cgi-bin/mycgiprogram <h1>Web page follows.<h1>
This sets a cookie which will always be sent back to your
server along with every request for a document on your server with
a local URL beginning with /cgi-bin/mycgiprogram
. The
cookie will continue to be sent until the expiration time. The
expiration time should be set using Greenwich Mean Time as shown
above, but note that the browser may have a poor idea of the local
time zone. For that reason it is best to set cookies to expire at
least 24 hours in the future.
When your CGI program is accessed again by the user, the cookies sent by the browser will appear in the HTTP_COOKIE environment variable. each cookie will appear as a NAME=VALUE pair; pairs will be separated by a semicolon followed by optional white space.
As with form submissions, unusual characters in cookies should be escaped using the %xx notation (% followed by two hexadecimal digits specifying the ascii code of the character).
See Netscape's Cookie Specification Page <URL:http://www.netscape.com/newsref/std/cookie_spec.html> for more detailed and precise information.