Security concerns regarding cookies, code injection, etc

Question

I'm using PHP to set cookies and am wondering what security risks exist around cookies.

For example is code injection possible, like can someone set a cookie to mail(blah, blah, blah); and send spam from my server? Or set a cookie to file_get_contents('secretfile.txt'); to read sensitive system files?

I'm assuming that it depends on how the cookie is used, like this would obviously be stupid:

<?php
    exec($_COOKIE['cmd']);
?>

However, is using cookies to just set input values secure without sanitization?

Answer 1

No it is not. You can edit the values of cookies like of GET or POST Parameter.

Firebug is able to do this in Firefox and Chrome got the native Debugger in this, so also validate the content of your cookie.

This is a common mistake:

if(isset($_COOKIE['lang'])){
   $lang=$_COOKIE['lang'];
}else{
   $lang="english";
}

include ("translation/".$lang.".html");

This would allow in circumstances a Local File Inclusion (LFI), since the content of $_COOKIE['lang'] can be modified.

Answer 2

Cookies are as secure as user input. You should be very careful with them.