Sessions & Cookies 🍪

<?php
// HTTP is "stateless" — the server forgets you the instant a page finishes
// loading. A SESSION is how PHP remembers you across page loads.
//
// session_start() does the remembering. On the FIRST visit it:
//   1. generates a unique session ID (a long random string)
//   2. sends that ID to the browser in a cookie named PHPSESSID
//   3. creates a file on the server to hold YOUR data
// On every later visit the browser sends PHPSESSID back, and PHP reopens
// the matching file — so your data is waiting for you.

session_start();   // ALWAYS the first thing, before any HTML or echo

// $_SESSION is a "superglobal" — an array PHP fills in for you, readable
// from any file once the session is started. Write to it like any array:
$_SESSION['username'] = 'alice';   // stored on the SERVER, not the browser
$_SESSION['role']     = 'admin';

echo "Saved! Your session ID is: " . session_id() . "\n";
echo "Stored username: " . $_SESSION['username'] . "\n";
?>

Saved! Your session ID is: 8f3c1a9b7e2d4f60a1c5
Stored username: alice

<?php
// On a LATER page (e.g. dashboard.php) you start the session again to
// reconnect to the same data — you do NOT set the values a second time.
session_start();

// Always check a key EXISTS before reading it. isset() returns true only
// if the key is present and not null — this avoids "Undefined index" warnings.
if (isset($_SESSION['username'])) {
    echo "Welcome back, " . $_SESSION['username'] . "!\n";   // Welcome back, alice!
    echo "Your role is: " . $_SESSION['role'] . "\n";        // Your role is: admin
} else {
    echo "No one is logged in.\n";
}

// Removing data:
unset($_SESSION['role']);   // delete ONE key — 'username' still remains
echo isset($_SESSION['role']) ? "role still here\n" : "role removed\n";

// session_destroy() throws away the WHOLE session (used at logout, below).
?>

Welcome back, alice!
Your role is: admin
role removed

<?php
// The classic login-state pattern: store a user id when login succeeds,
// check for it on protected pages, clear it on logout.

session_start();

function login(string $username): void {
    // SECURITY: regenerate the ID the moment privileges change. This swaps
    // the old session ID for a fresh one so an attacker who planted an ID
    // earlier (session fixation) cannot ride your now-logged-in session.
    session_regenerate_id(true);          // true = delete the old session file
    $_SESSION['user_id']  = 42;
    $_SESSION['username'] = $username;
}

function isLoggedIn(): bool {
    return isset($_SESSION['user_id']);   // true once login() has run
}

function logout(): void {
    $_SESSION = [];        // 1) empty the data array
    session_destroy();     // 2) delete the session file on the server
}

login('alice');
echo isLoggedIn() ? "Logged in as {$_SESSION['username']}\n" : "Guest\n";

logout();
session_start();           // start a fresh, empty session to check
echo isLoggedIn() ? "Still logged in\n" : "Logged out\n";
?>

Logged in as alice
Logged out

<?php
// A COOKIE is a small piece of data stored in the BROWSER (max ~4KB).
// The browser sends it back on every request to the same site. Cookies are
// perfect for non-secret preferences: theme, language, "remember me".
//
// setcookie() sends a Set-Cookie HEADER, so — like session_start() — it must
// run BEFORE any output. Modern signature uses an options array:

setcookie('theme', 'dark', [
    'expires'  => time() + 60 * 60 * 24 * 30,  // now + 30 days (a UNIX timestamp)
    'path'     => '/',          // send the cookie for the WHOLE site, not just one folder
    'secure'   => true,         // only sent over HTTPS — never plain http
    'httponly' => true,         // JavaScript canNOT read it (blocks XSS theft)
    'samesite' => 'Strict',     // don't send on cross-site requests (blocks CSRF)
]);

setcookie('lang', 'en', [
    'expires'  => time() + 60 * 60 * 24 * 365,  // 1 year
    'path'     => '/',
]);

echo "Two cookies were sent in the response headers.\n";
echo "They will appear in \$_COOKIE on the NEXT request.\n";
?>

Two cookies were sent in the response headers.
They will appear in $_COOKIE on the NEXT request.

<?php
// On the NEXT request the browser sends the cookies back, and PHP fills the
// $_COOKIE superglobal for you. (No session_start() needed for cookies.)
//
// Imagine the browser sent: theme=dark; lang=en

if (isset($_COOKIE['theme'])) {
    echo "Your theme is: " . $_COOKIE['theme'] . "\n";   // Your theme is: dark
} else {
    echo "No theme set — using the default.\n";
}

// A null-coalescing default (??) is the tidy way to read with a fallback:
$lang = $_COOKIE['lang'] ?? 'en';   // use 'en' if the cookie is missing
echo "Language: " . $lang . "\n";  // Language: en

// DELETE a cookie by re-setting it with an expiry time in the PAST:
setcookie('theme', '', ['expires' => time() - 3600, 'path' => '/']);
echo "The theme cookie has been told to expire.\n";
?>

Your theme is: dark
Language: en
The theme cookie has been told to expire.

<?php
// 🎯 YOUR TURN — finish the login check. Fill each blank marked ___ , then run.

// 1) Start the session so $_SESSION works
___;                           // 👉 the function that starts/resumes a session

$_SESSION['user_id'] = 7;      // pretend a login already happened

// 2) Read the value safely — fill in the function that tests a key exists
if (___($_SESSION['user_id'])) {   // 👉 returns true only if the key is set
    echo "Logged in. User #" . $_SESSION['user_id'] . "\n";
} else {
    echo "Not logged in\n";
}

// ✅ Expected output:
//    Logged in. User #7
?>

Logged in. User #7

<?php
// 🎯 YOUR TURN — set ONE secure cookie, then read it back with a default.

// 1) Store the user's chosen theme for 7 days. Fill in the function name
//    and the two security flags that block JS access and force HTTPS.
___('theme', 'dark', [          // 👉 the function that sends a Set-Cookie header
    'expires'  => time() + 60 * 60 * 24 * 7,
    'path'     => '/',
    'secure'   => ___,          // 👉 true — HTTPS only
    'httponly' => ___,          // 👉 true — hide it from JavaScript
]);

// 2) On the next request, read it with 'light' as the fallback.
$theme = $_COOKIE['theme'] ?? ___;   // 👉 the default value in quotes: "light"
echo "Theme: " . $theme . "\n";

// ✅ Expected output (first run, before the cookie comes back): Theme: light
//    (after the browser returns the cookie):                    Theme: dark
?>

Theme: light