Lesson 10 • Intermediate
Sessions & Cookies 🍪
Persist data between page loads — use sessions for secure server-side storage and cookies for client-side preferences.
What You'll Learn in This Lesson
- • How sessions maintain state across HTTP requests
- • Setting, reading, and destroying session variables
- • Creating and deleting cookies with secure settings
- • When to use sessions vs cookies
- • Building a secure login system with "remember me"
Note: PHP runs on a server. Our examples simulate PHP logic using JavaScript. To run real PHP, install PHP.
🎯 Real-World Analogy: A session is like a coat check at a restaurant — you hand over your coat (data), get a numbered ticket (session ID), and the restaurant keeps your coat safe. A cookie is like a loyalty card you carry in your wallet — the store gives it to you, and you bring it back each visit so they remember your preferences.
Try It: PHP Sessions
Start sessions, store login data, check authentication status
JavaScript
// PHP Sessions (simulated in JavaScript)
console.log("=== How Sessions Work ===");
console.log();
console.log("HTTP is STATELESS — each request is independent.");
console.log("Sessions let you remember users between page loads.");
console.log();
console.log("1. User visits site → PHP generates session ID");
console.log("2. Session ID stored in browser cookie (PHPSESSID)");
console.log("3. Server stores data linked to that ID");
console.log("4. Next request → browser sends cookie → server finds
...Try It: Cookies & Security
Set secure cookies, compare sessions vs cookies, and build a login system
JavaScript
// PHP Cookies (simulated in JavaScript)
console.log("=== Sessions vs Cookies ===");
console.log();
console.log("Feature | Sessions | Cookies");
console.log("───────────────┼────────────────────┼────────────────────");
console.log("Stored on | Server | Client (browser)");
console.log("Security | More secure | Less secure");
console.log("Max size | No practical limit | 4KB per cookie");
console.log("Lifetime | Browser close* | Custom
...⚠️ Common Mistakes
⚠️
Not calling session_start() first — must be called before ANY output (even whitespace!). Put it at the very top of your PHP file.
⚠️
Storing sensitive data in cookies — cookies are stored on the client and can be tampered with. Never put passwords or secret tokens in cookies.
⚠️
Not regenerating session ID on login — always call
session_regenerate_id(true) after successful login to prevent session fixation attacks.💡
Pro Tip: Always set
httponly: true and secure: true on cookies to prevent JavaScript access and ensure HTTPS-only transmission.📋 Quick Reference — Sessions & Cookies
| Function | Purpose |
|---|---|
| session_start() | Start/resume a session |
| $_SESSION['key'] | Get/set session data |
| session_destroy() | Destroy entire session |
| setcookie() | Create/update a cookie |
| $_COOKIE['name'] | Read a cookie value |
| session_regenerate_id() | Prevent session fixation |
🎉 Lesson Complete!
You now understand state management in PHP! Next, level up with Object-Oriented Programming.
Sign up for free to track which lessons you've completed and get learning reminders.