Working With Sessions and Cookies in PHP

How PHP stores user data, remembers login states, and powers modern web apps with sessions, cookies and secure auth.

How PHP stores user data, remembers login states, and powers modern web applications.

Introduction

Whenever you login to a website, add items to your cart, or return to a page and find it remembers your preferences — that's thanks to sessions and cookies.

These two features are essential to all web applications:

• Cookies store small bits of data in the browser.
• Sessions store secure data on the server.

If you're building login systems, shopping carts, dashboards, or anything requiring user state — you must understand how both work.

This guide explains them simply with examples you can use right away.

1. What Are Cookies?

A cookie is a small piece of text stored on the user's browser.

• ✔ Remembering users ("Stay logged in")
• ✔ Tracking preferences (dark mode, language)
• ✔ Analytics & ad tracking
• ✔ Saving cart items for guests

Setting a Cookie in PHP

Reading a Cookie

Deleting a Cookie

Cookies are client-side , meaning they live in the user's browser.

2. What Are Sessions?

A session stores user data on the server and assigns it a unique ID.

• ✔ Login systems
• ✔ Shopping carts
• ✔ User permissions
• ✔ Remembering choices across pages

Starting a Session

This must appear at the top of the page, before any HTML output.

Storing Data in a Session

Accessing Session Data

Destroying a Session

Sessions are more secure than cookies because the data stays on your server, not in the user's browser.

3. How Sessions and Cookies Work Together

• Generates a random session ID
• Stores the data on the server
• Sends a cookie named PHPSESSID to the browser

This cookie does not contain data, only the session ID.

The user cannot read or modify the session data — it's all server-side.

• User authentication
• Admin dashboards
• Sensitive settings

4. Cookies vs Sessions (Quick Comparison)

Feature

Cookies

Sessions

Stored

Browser

Server

Size Limit

~4KB

Server memory

Security

Low

High

Lifetime

Controlled by expiry

Until session timeout

Best For

Preferences, tracking

Login, cart, secure data

Store sensitive data in sessions, not cookies.

5. Practical Example: Login System Flow

1. User logs in via form

2. Accessing protected pages

3. Logging out

6. Secure Cookie Tips

❗ Never store passwords or sensitive data in cookies

• secure = protects from man-in-the-middle
• httponly = prevents JavaScript stealing cookies
• samesite = prevents CSRF attacks

7. When to Use Cookies vs Sessions

Use Cookies When:

• You need long-term remembering
• Data is non-sensitive (theme, language)
• You want preferences saved even after browser closes

Use Sessions When:

• User is logged in
• Sensitive data is stored
• Temporary workflow (checkout, form steps)
• You want server-side control

8. Summary

• ✔ What cookies are
• ✔ What sessions are
• ✔ How PHP generates session IDs
• ✔ How to read, write, and delete both
• ✔ When to use each
• ✔ Security best practices
• ✔ Login system examples

Sessions and cookies form the foundation of all web apps. Master these and you can build authentication systems, dashboards, e-commerce carts, and more.

Related articles

• Building Your First REST API with PHP — Step-by-step guide to creating a RESTful API using PHP and best practices for API design.
• PHP Security Best Practices: A Complete Guide — Master SQL injection prevention, XSS protection, CSRF tokens, password security, and file upload safety in PHP.
• ⭐ Boost Your Coding Speed With AI Tools — Discover the exact AI tools and strategy that help beginners learn 10x faster while building real apps and websites.