21. PHP Sessions and Cookies

What you will learn

• Why websites need to remember visitors
• How cookies and sessions differ
• How to start a session and store data
• How to build a simple login-style flow safely

The problem: HTTP forgets

Every page request is separate. The server does not remember that the same visitor loaded the last page. To keep a shopping basket or a login, the site must give the browser something to carry from page to page.

Cookies

A cookie is a small piece of text stored in the visitor’s browser. The browser sends it back with every request to your site.

<?php
setcookie("theme", "dark", [
    "expires"  => time() + 60 * 60 * 24 * 30,   // 30 days
    "path"     => "/",
    "secure"   => false,     // set to true on a live HTTPS site
    "httponly" => true,
    "samesite" => "Lax",
]);

echo "Cookie sent. Open read-cookie.php next.";

<?php
$theme = $_COOKIE["theme"] ?? "light";

echo "Your theme is: " . htmlspecialchars($theme, ENT_QUOTES, "UTF-8");

• setcookie() must run before any output.
• A cookie set on one request appears in $_COOKIE only from the next request.
• httponly hides the cookie from JavaScript, and secure sends it only over HTTPS. samesite limits sending it from other sites.
• To delete a cookie, set it again with an expires time in the past.

Sessions

A session keeps data on the server. The browser holds only a random session ID in a cookie. PHP uses the ID to find the right data. This is why sessions are the right place for logins and baskets.

<?php
session_start();

if (!isset($_SESSION["visits"])) {
    $_SESSION["visits"] = 0;
}
$_SESSION["visits"]++;

echo "You have loaded this page " . $_SESSION["visits"] . " time(s) in this session.";

• Call session_start() at the very top, before any output, on every page that uses the session.
• Store data in $_SESSION, which works like any associative array.

Cookie or session?

A simple login flow

This example shows the idea with a fixed user so you can see the moving parts. A real site stores users in a database and checks passwords with password_verify(), as the next lessons explain.

<?php
session_start();

$error = "";

if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $user = trim($_POST["username"] ?? "");
    $pass = $_POST["password"] ?? "";

    // Demo only: a real site checks a stored password HASH
    $demo_hash = password_hash("secret123", PASSWORD_DEFAULT);

    if ($user === "sam" && password_verify($pass, $demo_hash)) {
        session_regenerate_id(true);       // new ID after login
        $_SESSION["user"] = "sam";
        header("Location: dashboard.php");
        exit;
    }

    $error = "Wrong username or password.";
}
?>
<form method="post">
  <label for="u">Username</label>
  <input type="text" id="u" name="username">
  <label for="p">Password</label>
  <input type="password" id="p" name="password">
  <button type="submit">Log in</button>
</form>
<p><?= htmlspecialchars($error, ENT_QUOTES, "UTF-8") ?></p>

<?php
session_start();

if (!isset($_SESSION["user"])) {
    header("Location: login.php");
    exit;
}

echo "Welcome, " . htmlspecialchars($_SESSION["user"], ENT_QUOTES, "UTF-8") . "! ";
echo '<a href="logout.php">Log out</a>';

<?php
session_start();

$_SESSION = [];
if (ini_get("session.use_cookies")) {
    $p = session_get_cookie_params();
    setcookie(session_name(), "", time() - 3600, $p["path"], $p["domain"], $p["secure"], $p["httponly"]);
}
session_destroy();

header("Location: login.php");
exit;

Session security habits

• Call session_regenerate_id(true) right after a successful login, to stop session fixation.
• Protect every private page by checking $_SESSION at the top, then exit after the redirect.
• Use HTTPS on a live site, and mark session cookies secure and httponly.
• Never put the session ID in a web address.
• Store as little as possible in a session, and never store a plain password.
• Offer a logout that destroys the session fully.

Common mistakes

• Output before session_start() or setcookie(), giving “headers already sent”.
• Forgetting session_start() on one of the pages.
• Expecting a new cookie to be readable in the same request.
• Trusting cookie values.
• Forgetting exit after a redirect, so the page keeps running.
• Not regenerating the session ID after login.

<?php
session_start();

$allowed = ["red", "green", "blue"];
$color = $_GET["color"] ?? "";

if (in_array($color, $allowed, true)) {
    $_SESSION["color"] = $color;
}

echo "Your colour is: " . htmlspecialchars($_SESSION["color"] ?? "none", ENT_QUOTES, "UTF-8");

Summary

• Cookies live in the browser and can be edited, so use them only for harmless preferences.
• Sessions keep data on the server, and the browser holds only an ID.
• Start sessions before output, regenerate the ID on login, protect private pages, and log out properly.