Cookie expiration and security in PHP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to set a cookie named 'user' with value 'John'.

PHP

<?php
setcookie('user', 'John', [1]);
?>

Drag options to blanks, or click blank then click option'

Atime() + 3600

B3600

C'3600'

Dtime() - 3600

Attempts:

3 left

💡 Hint

Common Mistakes

Using just 3600 instead of time() + 3600 causes the cookie to expire immediately.

Passing the expiration time as a string instead of an integer.

The third parameter of setcookie is the expiration time in Unix timestamp format. Using time() + 3600 sets the cookie to expire in one hour.

2fill in blank

medium

Complete the code to set a secure cookie that is only sent over HTTPS.

PHP

<?php
setcookie('session', 'abc123', time() + 3600, '/', '', [1], true);
?>

Drag options to blanks, or click blank then click option'

A1

Bfalse

Ctrue

D0

Attempts:

3 left

💡 Hint

Common Mistakes

Setting secure flag to false or 0 allows cookie over HTTP.

Passing secure flag as string instead of boolean.

The sixth parameter of setcookie controls the 'secure' flag. Setting it to true ensures the cookie is sent only over HTTPS.

3fill in blank

hard

Fix the error in the code to set a cookie with HttpOnly flag.

PHP

<?php
setcookie('token', 'xyz', time() + 3600, '/', '', false, [1]);
?>

Drag options to blanks, or click blank then click option'

Afalse

B0

C1

Dtrue

Attempts:

3 left

💡 Hint

Common Mistakes

Setting HttpOnly flag to false leaves cookie vulnerable to XSS.

Passing HttpOnly flag as string instead of boolean.

The seventh parameter of setcookie is the HttpOnly flag. Setting it to true helps protect the cookie from being accessed by JavaScript.

4fill in blank

hard

Fill both blanks to set a cookie that expires in 2 hours and is restricted to the '/account' path.

PHP

<?php
setcookie('auth', 'token123', [1], [2]);
?>

Drag options to blanks, or click blank then click option'

Atime() + 7200

B'/'

C'/account'

Dtime() + 3600

Attempts:

3 left

💡 Hint

Common Mistakes

Using 3600 seconds instead of 7200 for 2 hours.

Setting path to '/' instead of '/account'.

The expiration time is set to 2 hours from now using time() + 7200. The path parameter restricts the cookie to the '/account' directory.

5fill in blank

hard

Fill all three blanks to set a cookie with name in uppercase, value from variable, and secure flag enabled.

PHP

<?php
$name = 'sessionid';
$value = 'abc123';
setcookie([1], [2], time() + 3600, '/', '', [3], true);
?>

Drag options to blanks, or click blank then click option'

A$name

B$value

Ctrue

Dstrtoupper($name)

Attempts:

3 left

💡 Hint

Common Mistakes

Passing the variable name as string instead of its value.

Not converting the cookie name to uppercase.

Setting secure flag to false.

The cookie name is converted to uppercase using strtoupper($name). The value is passed as $value. The secure flag is set to true to restrict cookie to HTTPS.