Sessions and Cookies in PHP
Sessions and Cookies in PHP
Sessions and cookies are essential for maintaining user data across multiple pages in PHP.
1. PHP Sessions
A session is a way to store information about a user across multiple pages. It is stored on the server and lasts until the user closes the browser or the session is destroyed.
1.1 Starting a Session (session_start())
Before using session variables, you must start a session on each page:
<?php
session_start(); // Must be at the top of the page
?>
1.2 Storing Data in a Session
✅ Example: Setting Session Variables (session1.php)
<?php
session_start(); // Start the session
$_SESSION["username"] = "JohnDoe";
$_SESSION["email"] = "john@example.com";
echo "Session variables are set.";
?>
📌 Explanation:
$_SESSION["key"] = "value"; stores session data.
Data is available across all pages of the website.
1.3 Retrieving Session Data
✅ Example: Accessing Session Data (session2.php)
<?php
session_start(); // Start the session
echo "Username: " . $_SESSION["username"] . "<br>>";
echo "Email: " . $_SESSION["email"];
?>
1.4 Checking If a Session is Set
<?php
session_start();
if (isset($_SESSION["username"])) {
echo "Welcome, " . $_SESSION["username"];
} else {
echo "No session data found.";
}
?>
1.5 Destroying a Session (session_destroy())
✅ Example: Ending a Session (logout.php)
<?php
session_start();
session_unset(); // Unset all session variables
session_destroy(); // Destroy the session
echo "Session destroyed. User logged out.";
?>
📌 Explanation:
session_unset() removes session variables.
session_destroy() removes session data completely.
2. PHP Cookies
A cookie is a small file stored on the user’s device. Cookies store user preferences, login details, and other data for a specified time.
2.1 Setting a Cookie (setcookie())
✅ Example: Creating a Cookie (setcookie.php)
<?php
$cookie_name = "user";
$cookie_value = "JohnDoe";
setcookie($cookie_name, $cookie_value, time() + (86400 * 7), "/"); // 7-day cookie
echo "Cookie set successfully.";
?>
📌 Explanation:
setcookie(name, value, expiry_time, path);
time() + (86400 * 7): Expires in 7 days.
"user" is the cookie name and "JohnDoe" is the cookie value.
2.2 Retrieving a Cookie ($_COOKIE)
✅ Example: Reading a Cookie (getcookie.php)
<?php
if (isset($_COOKIE["user"])) {
echo "Welcome, " . $_COOKIE["user"];
} else {
echo "No cookie found.";
}
?>
📌 Explanation:
Use $_COOKIE["cookie_name"] to retrieve a cookie.
2.3 Deleting a Cookie
✅ Example: Deleting a Cookie (deletecookie.php)
<?php
setcookie("user", "", time() - 3600, "/"); // Expire the cookie
echo "Cookie deleted.";
?>
📌 Explanation:
To delete a cookie, set the expiry time in the past.
3. Session vs. Cookie: Key Differences
Feature Session Cookie
Storage Server User's browser
Security More secure Less secure (stored on client-side)
Size Limit Large Limited (~4KB)
Data Expiry Until browser is closed (or manually destroyed) Custom expiry time
Usage Login, cart items, user preferences Remembering login, user preferences
4. Cookie Security Best Practices
Use httponly to prevent JavaScript access
setcookie("user", "JohnDoe", time() + 3600, "/", "", false, true);
true for httponly makes it inaccessible to JavaScript (prevents XSS attacks).
Use secure for HTTPS-only cookies
setcookie("user", "JohnDoe", time() + 3600, "/", "", true, true);
true for secure ensures the cookie is only sent over HTTPS.
Encrypt sensitive cookie data
$encrypted_value = base64_encode("JohnDoe");
setcookie("user", $encrypted_value, time() + 3600, "/");
Prevents easy tampering of cookie values.
Conclusion
✅ Sessions → Store temporary data on the server (user login, cart data).
✅ Cookies → Store small data on the client-side (remember user preferences).
Date: 2025-03-28 00:00:00.000000