How cookies work in PHP - Practice Exercises

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this PHP cookie code?

Consider this PHP script that sets a cookie and then tries to read it immediately:

<?php
setcookie('user', 'Alice', time() + 3600);
if (isset($_COOKIE['user'])) {
    echo 'User is ' . $_COOKIE['user'];
} else {
    echo 'No user cookie found';
}
?>

What will this script output when run for the first time in a browser?

PHP

<?php
setcookie('user', 'Alice', time() + 3600);
if (isset($_COOKIE['user'])) {
    echo 'User is ' . $_COOKIE['user'];
} else {
    echo 'No user cookie found';
}
?>

A User is Alice

B User is

C Error: Undefined index 'user'

D No user cookie found

💡 Hint

Remember that cookies are sent by the browser on the next request, not immediately.

When you set a cookie with setcookie(), it sends a header to the browser. The cookie is not available in $_COOKIE until the next page load because the browser must send it back in the request headers.

🧠 Conceptual

intermediate

Which HTTP header is used to set a cookie?

When a server wants to store a cookie on a user's browser, which HTTP response header does it use?

A Set-Cookie

B Content-Type

C Authorization

D Cookie

💡 Hint

Think about the header sent from server to client to store data.

The server uses the Set-Cookie header to tell the browser to store a cookie. The browser then sends the cookie back in the Cookie header on future requests.

❓ Predict Output

advanced

What is the output of this PHP cookie deletion code?

Look at this PHP code that tries to delete a cookie:

<?php
setcookie('session', '', time() - 3600);
if (isset($_COOKIE['session'])) {
    echo 'Session cookie exists';
} else {
    echo 'Session cookie deleted';
}
?>

What will this script output when run immediately after the cookie was set previously?

PHP

<?php
setcookie('session', '', time() - 3600);
if (isset($_COOKIE['session'])) {
    echo 'Session cookie exists';
} else {
    echo 'Session cookie deleted';
}
?>

A Error: Cannot delete cookie

B Session cookie exists

C Session cookie deleted

D Session cookie

💡 Hint

Think about when the cookie is actually removed from $_COOKIE.

Setting a cookie with a past expiration date tells the browser to delete it, but $_COOKIE still contains the cookie data for the current request. The cookie will be gone on the next request.

🔧 Debug

advanced

Why does this PHP cookie code cause a warning?

Consider this PHP code snippet:

<?php
setcookie('theme', 'dark');
echo $_COOKIE['theme'];
?>

When run, it sometimes shows a warning: Undefined index: theme. Why?

PHP

<?php
setcookie('theme', 'dark');
echo $_COOKIE['theme'];
?>

A Because the cookie is not available in $_COOKIE until the next request

B Because setcookie() does not actually set cookies

C Because $_COOKIE is read-only and cannot be accessed

D Because 'theme' is a reserved keyword in PHP

💡 Hint

Think about when cookies become available in PHP.

Cookies set by setcookie() are sent to the browser in headers. The browser sends them back on the next request. So, $_COOKIE does not contain the new cookie until the next page load.

🚀 Application

expert

How many cookies will be sent to the server?

A website sets these cookies with these paths:

• Cookie A: path=/
• Cookie B: path=/shop
• Cookie C: path=/shop/sale

If the browser requests the URL https://example.com/shop/sale/item1, how many cookies will be sent to the server?

A 1

B 2

C 3

D 0

💡 Hint

Cookies are sent if the request path starts with the cookie's path.

All three cookies have paths that match the request URL path. The request path /shop/sale/item1 starts with /, /shop, and /shop/sale, so all three cookies are sent.

Practice

1. What is the primary purpose of cookies in PHP?

easy

A. To execute server-side scripts

B. To style web pages dynamically

C. To create database connections

D. To store small pieces of data on the user's computer

Solution

1. Step 1: Understand what cookies do

   Cookies save small data on the user's computer to remember information like preferences or login status.

2. Step 2: Identify the correct purpose

   Among the options, only storing small data on the user's computer matches the purpose of cookies.

3. Final Answer:

   To store small pieces of data on the user's computer -> Option D

4. Quick Check:

   Cookies store data = B [OK]

Hint: Cookies save data on user device, not server tasks [OK]

Common Mistakes:

• Confusing cookies with server-side code execution
• Thinking cookies style web pages
• Assuming cookies manage database connections

2. Which of the following is the correct syntax to set a cookie named user with value John in PHP?

easy

A. setcookie('user', 'John');

B. cookie_set('user', 'John');

C. set_cookie('user', 'John');

D. setcookie(user, John);

Solution

1. Step 1: Recall the PHP function to set cookies

   The correct PHP function is setcookie() with parameters as strings.

2. Step 2: Check syntax correctness

   setcookie('user', 'John'); uses correct function name and quotes around parameters, making it valid syntax.

3. Final Answer:

   setcookie('user', 'John'); -> Option A

4. Quick Check:

   Correct function and quotes = A [OK]

Hint: Use setcookie() with quoted strings for name and value [OK]

Common Mistakes:

• Using wrong function names like cookie_set or set_cookie
• Forgetting quotes around cookie name or value
• Passing variables without quotes incorrectly

3. What will be the output of the following PHP code?

setcookie('color', 'blue');
if(isset($_COOKIE['color'])) {
    echo $_COOKIE['color'];
} else {
    echo 'No cookie set';
}

medium

A. blue

B. No cookie set

C. Undefined index error

D. Syntax error

Solution

1. Step 1: Understand when cookies are available

   Cookies set by setcookie() are available on the next page load, not immediately in the same script.

2. Step 2: Check the condition in the code

   Since the cookie is not yet set in $_COOKIE during this script run, isset($_COOKIE['color']) is false, so it prints 'No cookie set'.

3. Final Answer:

   No cookie set -> Option B

4. Quick Check:

   Cookie available next request = A [OK]

Hint: Cookies appear in $_COOKIE on next page load, not immediately [OK]

Common Mistakes:

• Expecting cookie immediately after setcookie() in same script
• Assuming $_COOKIE is updated instantly
• Confusing cookie setting with session variables

4. Identify the error in this PHP code snippet that tries to set a cookie:

setcookie('theme', 'dark', time() + 3600)
echo 'Cookie set!';

medium

A. Missing semicolon after setcookie() call

B. Incorrect function name

C. Wrong parameter order in setcookie()

D. Cookies cannot be set with expiration time

Solution

1. Step 1: Check PHP syntax rules

   Each PHP statement must end with a semicolon (;). The setcookie() call is missing this.

2. Step 2: Verify function name and parameters

   The function name and parameters are correct, and expiration time is valid.

3. Final Answer:

   Missing semicolon after setcookie() call -> Option A

4. Quick Check:

   Semicolon missing = C [OK]

Hint: Always end PHP statements with semicolon [OK]

Common Mistakes:

• Forgetting semicolon at end of function calls
• Thinking expiration time is invalid
• Confusing function names

5. You want to create a cookie that lasts for 7 days, is only accessible over HTTPS, and cannot be accessed by JavaScript. Which of the following setcookie() calls correctly achieves this?

hard

A. setcookie('session', 'active', time() + 604800);

B. setcookie('session', 'active', time() + 604800, '/', '', false, true);

C. setcookie('session', 'active', time() + 604800, '/', '', true, true);

D. setcookie('session', 'active', time() + 604800, '/', '', true, false);

Solution

1. Step 1: Calculate expiration time for 7 days

   7 days = 7 * 24 * 3600 = 604800 seconds, so time() + 604800 is correct.

2. Step 2: Set secure and httponly flags

   To make cookie HTTPS-only, set the secure flag to true. To improve security, httponly should also be true.

3. Step 3: Check options

   setcookie('session', 'active', time() + 604800, '/', '', true, true); sets secure and httponly to true, matching requirements. Others either disable secure or httponly or omit parameters.

4. Final Answer:

   setcookie('session', 'active', time() + 604800, '/', '', true, true); -> Option C

5. Quick Check:

   Secure and httponly true for HTTPS cookie = D [OK]

Hint: Use secure=true and httponly=true for HTTPS cookies [OK]

Common Mistakes:

• Not setting secure flag to true for HTTPS-only cookies
• Omitting httponly flag for security
• Incorrect expiration time calculation