CodeBlanks Logo Icon CodeBlanks
Login Register

Session vs cookie

PHP course · Intermediate · Lesson 92/115

Learn the difference between session and cookie and when to use each.

Session or cookie?

Session data is stored on the server; you write into $_SESSION. The user only carries an id cookie; the real data stays on the server.

A cookie is stored in the browser. The browser sends it back on every request; the server reads it.

Sessions are safer (the user does not see the data) and suit larger data. Cookies are for small, non-sensitive data like preferences (theme, language).

When to use which?

Session: for sensitive or larger data like the logged-in user id, cart total, role level. Stored on the server; the user cannot change it.

Cookie: for non-sensitive small data like theme (dark/light), language preference, a 'remember me' flag. Lives in the browser; can have an expiration.

Both can be used together: the session id is carried in a cookie. Never store sensitive data in a cookie.

Exercise Use session and cookie together

Call session_start(). Set $_SESSION['user_id'] = 42. Also set a one-day cookie with setcookie('last_visit', 'today', time() + 86400). Then echo stored.

Show example solution 
Call session_start, set $_SESSION['user_id']=42, set the cookie with setcookie('last_visit', 'today', time() + 86400), then echo "stored".
Example solution:
<?php
// Start a session, set a cookie and print 'stored'
session_start();
$_SESSION['user_id'] = 42;
setcookie('last_visit', 'today', time() + 86400);
echo "stored\n";

Test yourself

  1. Which is stored on the server side?

    • $_COOKIE
    • Set-Cookie header
    • Browser memory
    • $_SESSION
    Show answer

    $_SESSION — Correct. $_SESSION data is kept on the server; the browser only carries an id cookie.

  2. Pick the right storage for a sensitive id

    <?php
// Pick the right storage for sensitive data
$choice = ['sensitive' => '____'];
echo $choice['sensitive'];
    Show answer 
    <?php
// Pick the right storage for sensitive data
$choice = ['sensitive' => 'session'];
echo $choice['sensitive'];

  3. Match the session vs cookie differences

    $_SESSION
    Server side
    $_COOKIE
    In the browser
    ~4 KB limit
    For cookies
    Ends on browser close
    For sessions

All lessons in Intermediate

1 Classes

  1. Defining a class
  2. Defining properties
  3. Defining methods
  4. In-class access with $this
  5. Instantiating with new
  6. Summary - Classes

2 Constructor

  1. The __construct method
  2. Passing parameters to the constructor
  3. Initializing properties
  4. Class type declaration
  5. The __destruct method
  6. Summary - Constructor

3 Inheritance

  1. Inheritance with extends
  2. Accessing parent with parent::
  3. Method override
  4. protected property and method
  5. Inheritance chain
  6. Summary - Inheritance

4 Project: Utility library

  1. Project: Utility library
  2. Class skeleton
  3. Adding methods
  4. Using with file inclusion
  5. Project final - Library

5 Visibility

  1. public access
  2. protected access
  3. private access
  4. Encapsulation
  5. Getter and setter methods
  6. Summary - Visibility

6 Static members

  1. static property
  2. static method
  3. In-class access with self::
  4. Late static binding with static::
  5. static vs instance
  6. Summary - Static members

7 Class constants

  1. Class constants with const
  2. Accessing constants
  3. Class name with ::class
  4. Class constants vs static
  5. Constant use cases
  6. Summary - Class constants

8 Project: Quiz app

  1. Project: Quiz app
  2. Designing a question class
  3. Checking answers
  4. Computing the score
  5. Project final - Quiz app

9 Interfaces

  1. Defining interfaces
  2. Implementing with implements
  3. Multiple interfaces
  4. Polymorphism
  5. interface vs abstract
  6. Summary - Interfaces

10 Abstract classes

  1. Defining abstract classes
  2. abstract methods
  3. Abstract class inheritance
  4. Template method pattern
  5. Constructor and abstract
  6. Summary - Abstract classes

11 Traits

  1. Defining traits
  2. Using traits with use
  3. Multiple traits
  4. Resolving method conflicts
  5. Trait vs inheritance
  6. Summary - Traits

12 Project: Blog app

  1. Project: Blog app
  2. Creating a post class
  3. Adding posts with a form
  4. Displaying the post list
  5. Project final - Blog

13 File handling

  1. Reading with file_get_contents()
  2. Writing with file_put_contents()
  3. Opening files with fopen()
  4. fwrite() and fread()
  5. Closing files with fclose()
  6. Summary - File handling

14 File upload

  1. The $_FILES superglobal
  2. move_uploaded_file()
  3. Validating file type
  4. File size limit
  5. Upload error handling
  6. Summary - File upload

15 Sessions

  1. Starting a session with session_start()
  2. Storing data with $_SESSION
  3. Reading from a session
  4. unset() and session_destroy()
  5. Login/logout logic
  6. Summary - Sessions

16 Cookies

  1. Creating cookies with setcookie()
  2. Reading cookies with $_COOKIE
  3. Cookie expiration
  4. Deleting cookies
  5. Session vs cookie
  6. Summary - Cookies

17 Project: Contact form

  1. Project: Contact form
  2. Form skeleton
  3. Validating data
  4. Integrating file upload
  5. Project final - Contact form

18 Error handling

  1. The try/catch block
  2. Throwing exceptions with throw
  3. The Exception class
  4. error_reporting configuration
  5. Custom exception classes
  6. Summary - Error handling

19 Date and time

  1. Formatting dates with date()
  2. Timestamps with time()
  3. Parsing dates with strtotime()
  4. The DateTime class
  5. DateInterval and DatePeriod
  6. Summary - Date and time

20 Intermediate final

  1. Challenge - OOP app
  2. Challenge - File and session
  3. Challenge - Multi-step registration form
  4. Challenge - Error handling
  5. Challenge - Mini API