Handling user authentication, shopping carts, and preferences in PHP? You’ll need sessions and cookies!
🎯 In this guide, you’ll learn:
✅ The difference between sessions and cookies
✅ How to use PHP sessions securely
✅ How to store user data in cookies
✅ How to implement a simple login system with sessions
✅ Best security practices for session handling
By the end, you’ll have a fully functional session-based authentication system! 🚀
1️⃣ What Are Sessions and Cookies?
💡 Sessions and cookies both store user data, but they work differently.
| Feature | Sessions | Cookies |
|---|---|---|
| Stored In | Server | User’s browser |
| Data Type | Can store complex data (arrays, objects) | Stores only strings |
| Security | More secure (data is not exposed to users) | Less secure (stored in user’s browser) |
| Lifetime | Ends when the user closes the browser (unless configured) | Can persist for days/weeks |
| Best For | User authentication, shopping carts | Remembering user preferences |
🔥 Which one should you use?
✅ Use sessions for authentication & sensitive data.
✅ Use cookies for storing user preferences (e.g., dark mode, language settings).
2️⃣ Using PHP Sessions
💡 Sessions store user data on the server and assign a unique session_id to each user.
1️⃣ Starting a Session
<?php
session_start(); // Always start the session at the top
$_SESSION["username"] = "Zero Dev"; // Storing data in session
echo "Hello, " . $_SESSION["username"];
?>
🔥 What’s happening?
✅ session_start() creates or resumes a session.
✅ $_SESSION stores data server-side.
2️⃣ Accessing Session Data
<?php
session_start();
echo "Welcome back, " . $_SESSION["username"]; // Output: Welcome back, Zero Dev
?>
3️⃣ Destroying a Session (Logout)
<?php
session_start();
session_destroy(); // Removes all session data
header("Location: login.php"); // Redirect user
?>
🔥 Why destroy sessions?
✅ Prevents unauthorized access after logout.
3️⃣ Using PHP Cookies
💡 Cookies store small pieces of data in the user's browser.
1️⃣ Setting a Cookie
<?php
setcookie("username", "Zero Dev", time() + 3600, "/"); // Expires in 1 hour
?>
🔥 What’s happening?
✅ setcookie(name, value, expiration, path) creates a cookie.
✅ Lasts for 1 hour (time() + 3600).
2️⃣ Accessing a Cookie
<?php
if (isset($_COOKIE["username"])) {
echo "Hello, " . $_COOKIE["username"];
}
?>
🔥 Why use cookies?
✅ Stores lightweight user preferences (e.g., theme, language).
3️⃣ Deleting a Cookie
<?php
setcookie("username", "", time() - 3600, "/"); // Set expiration in the past
?>
🔥 Why delete cookies?
✅ Resets user preferences.
4️⃣ Mini Project: Login System with Sessions
🚀 Let’s build a simple login system using sessions.
1️⃣ Create login.php (User Login)
<?php
session_start();
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$username = $_POST["username"];
$password = $_POST["password"];
if ($username == "admin" && $password == "12345") { // Simple authentication
$_SESSION["user"] = $username;
header("Location: dashboard.php");
} else {
echo "Invalid login credentials!";
}
}
?>
<form method="POST">
<input type="text" name="username" placeholder="Enter Username" required>
<input type="password" name="password" placeholder="Enter Password" required>
<button type="submit">Login</button>
</form>
🔥 What happens?
✅ Stores the username in a session after login.
✅ Redirects the user to dashboard.php.
2️⃣ Create dashboard.php (Protected Page)
<?php
session_start();
if (!isset($_SESSION["user"])) {
header("Location: login.php"); // Redirect if not logged in
exit();
}
echo "Welcome, " . $_SESSION["user"];
?>
<a href="logout.php">Logout</a>
🔥 Why check for $_SESSION["user"]?
✅ Prevents unauthorized users from accessing the dashboard.
3️⃣ Create logout.php
<?php
session_start();
session_destroy(); // Remove session data
header("Location: login.php"); // Redirect to login page
?>
🔥 Now users can log out securely! 🎉
5️⃣ Best Security Practices for Sessions & Cookies
✅ Use HTTPS: Encrypts session & cookie data.
✅ Regenerate Session ID on login:
session_regenerate_id(true);
✅ Set HttpOnly & Secure flags for cookies:
setcookie("user", "Zero Dev", time() + 3600, "/", "", true, true);
✅ Use session timeout:
if (!isset($_SESSION["LAST_ACTIVITY"]) || time() - $_SESSION["LAST_ACTIVITY"] > 1800) {
session_unset(); session_destroy();
}
$_SESSION["LAST_ACTIVITY"] = time();
🔥 Why?
✔ Prevents session hijacking.
✔ Improves security.
🚀 Final Thoughts
Now you know how to handle sessions and cookies like a pro!
✅ Use sessions for authentication
✅ Use cookies for lightweight data
✅ Secure your sessions with best practices
👉 Next: File Upload Handling in PHP
Happy coding! 🎉🚀