Sessions, Cookies & security - Concepts

Introduction to Sessions, Cookies & security

Key Concepts

• Deep understanding of sessions, cookies & security — not just the syntax and API, but the reasoning behind design decisions, the trade-offs involved, and the historical context that explains why things work the way they do Grasping these fundamentals is essential because they form the backbone of every advanced technique you will learn later
• Practical applications and real-world use cases — a critical concept in server-side web development that you will use frequently in real projects. Each concept is demonstrated with hands-on examples drawn from real-world PHP projects that thousands of developers use daily
• Step-by-step implementation guides — a critical concept in server-side web development that you will use frequently in real projects. Follow along carefully — each step builds on the previous one, creating a solid chain of understanding that will serve you throughout your career
• Common patterns and best practices — a critical concept in server-side web development that you will use frequently in real projects. These patterns have been refined by the developer community over years of experience and are considered industry standards
• Tips for debugging and troubleshooting — a critical concept in server-side web development that you will use frequently in real projects. Debugging is a skill that improves with practice — the tips here come from common real-world issues that even experienced developers encounter
• Performance optimization techniques — a critical concept in server-side web development that you will use frequently in real projects. Writing efficient code is not just about speed — it improves user experience, reduces server costs, and makes your applications feel professional

Sessions, Cookies & security - Code Example

<?php
// Sessions
session_start();
$_SESSION["user"] = "Alice";
$_SESSION["role"] = "admin";

echo "User: " . ($_SESSION["user"] ?? "Guest") . "\n";

// Cookies
setcookie("theme", "dark", time() + 86400 * 30, "/");
$theme = $_COOKIE["theme"] ?? "light";

// CSRF Protection
function generateToken(): string {
    $token = bin2hex(random_bytes(32));
    $_SESSION["csrf_token"] = $token;
    return $token;
}

function validateToken(string $token): bool {
    return hash_equals($_SESSION["csrf_token"] ?? "", $token);
}

// Password Hashing
$hash = password_hash("secret123", PASSWORD_DEFAULT);
echo "Valid: " . (password_verify("secret123", $hash) ? "Yes" : "No") . "\n";
?>

Try It Yourself: Sessions, Cookies & security

<?php
// Input validation & sanitization
function sanitize(string $input): string {
    return htmlspecialchars(trim($input), ENT_QUOTES, "UTF-8");
}

function validateEmail(string $email): bool {
    return filter_var($email, FILTER_VALIDATE_EMAIL) !== false;
}

// Test
$inputs = [
    "name" => "  <script>alert(1)</script>  ",
    "email" => "user@example.com",
    "bad_email" => "not-an-email"
];

echo "Clean name: " . sanitize($inputs["name"]) . "\n";
echo "Valid email: " . (validateEmail($inputs["email"]) ? "Yes" : "No") . "\n";
echo "Bad email: " . (validateEmail($inputs["bad_email"]) ? "Yes" : "No") . "\n";

$hash = password_hash("mypassword", PASSWORD_DEFAULT);
echo "Hash: $hash\n";
echo "Verify: " . (password_verify("mypassword", $hash) ? "Yes" : "No") . "\n";
?>

Quick Quiz: Sessions, Cookies & security