How cookies work in PHP - Why You Should Know This

The Big Idea

What if your favorite website could remember you perfectly without asking again and again?

The Scenario

Imagine you visit an online store and add items to your cart. Without cookies, every time you click a new page, the website forgets what you added. You have to start over, adding items again and again.

The Problem

Manually tracking your choices on every page means the website must send all your data back and forth each time. This is slow, confusing, and easy to lose information. It feels like repeating the same steps endlessly.

The Solution

Cookies let the website save small pieces of information on your computer. This way, the site remembers your cart, login, or preferences as you browse, making your experience smooth and personal without asking you to repeat actions.

Before vs After

✗ Before

$cart = [];
// No way to remember cart between pages
// User must add items every time

✓ After

setcookie('cart', json_encode($cart), time() + 3600);
// Cart saved in cookie, remembered across pages

What It Enables

Cookies enable websites to remember you and your choices, creating a seamless and personalized browsing experience.

Real Life Example

When you log into a social media site, cookies keep you logged in as you click around, so you don't have to enter your password on every page.

Key Takeaways

Without cookies, websites forget your actions between pages.

Cookies store small data on your device to remember your choices.

This makes browsing faster, easier, and more personal.

Practice

1. What is the primary purpose of cookies in PHP?

easy

A. To execute server-side scripts

B. To style web pages dynamically

C. To create database connections

D. To store small pieces of data on the user's computer

Solution

1. Step 1: Understand what cookies do

   Cookies save small data on the user's computer to remember information like preferences or login status.

2. Step 2: Identify the correct purpose

   Among the options, only storing small data on the user's computer matches the purpose of cookies.

3. Final Answer:

   To store small pieces of data on the user's computer -> Option D

4. Quick Check:

   Cookies store data = B [OK]

Hint: Cookies save data on user device, not server tasks [OK]

Common Mistakes:

• Confusing cookies with server-side code execution
• Thinking cookies style web pages
• Assuming cookies manage database connections

2. Which of the following is the correct syntax to set a cookie named user with value John in PHP?

easy

A. setcookie('user', 'John');

B. cookie_set('user', 'John');

C. set_cookie('user', 'John');

D. setcookie(user, John);

Solution

1. Step 1: Recall the PHP function to set cookies

   The correct PHP function is setcookie() with parameters as strings.

2. Step 2: Check syntax correctness

   setcookie('user', 'John'); uses correct function name and quotes around parameters, making it valid syntax.

3. Final Answer:

   setcookie('user', 'John'); -> Option A

4. Quick Check:

   Correct function and quotes = A [OK]

Hint: Use setcookie() with quoted strings for name and value [OK]

Common Mistakes:

• Using wrong function names like cookie_set or set_cookie
• Forgetting quotes around cookie name or value
• Passing variables without quotes incorrectly

3. What will be the output of the following PHP code?

setcookie('color', 'blue');
if(isset($_COOKIE['color'])) {
    echo $_COOKIE['color'];
} else {
    echo 'No cookie set';
}

medium

A. blue

B. No cookie set

C. Undefined index error

D. Syntax error

Solution

1. Step 1: Understand when cookies are available

   Cookies set by setcookie() are available on the next page load, not immediately in the same script.

2. Step 2: Check the condition in the code

   Since the cookie is not yet set in $_COOKIE during this script run, isset($_COOKIE['color']) is false, so it prints 'No cookie set'.

3. Final Answer:

   No cookie set -> Option B

4. Quick Check:

   Cookie available next request = A [OK]

Hint: Cookies appear in $_COOKIE on next page load, not immediately [OK]

Common Mistakes:

• Expecting cookie immediately after setcookie() in same script
• Assuming $_COOKIE is updated instantly
• Confusing cookie setting with session variables

4. Identify the error in this PHP code snippet that tries to set a cookie:

setcookie('theme', 'dark', time() + 3600)
echo 'Cookie set!';

medium

A. Missing semicolon after setcookie() call

B. Incorrect function name

C. Wrong parameter order in setcookie()

D. Cookies cannot be set with expiration time

Solution

1. Step 1: Check PHP syntax rules

   Each PHP statement must end with a semicolon (;). The setcookie() call is missing this.

2. Step 2: Verify function name and parameters

   The function name and parameters are correct, and expiration time is valid.

3. Final Answer:

   Missing semicolon after setcookie() call -> Option A

4. Quick Check:

   Semicolon missing = C [OK]

Hint: Always end PHP statements with semicolon [OK]

Common Mistakes:

• Forgetting semicolon at end of function calls
• Thinking expiration time is invalid
• Confusing function names

5. You want to create a cookie that lasts for 7 days, is only accessible over HTTPS, and cannot be accessed by JavaScript. Which of the following setcookie() calls correctly achieves this?

hard

A. setcookie('session', 'active', time() + 604800);

B. setcookie('session', 'active', time() + 604800, '/', '', false, true);

C. setcookie('session', 'active', time() + 604800, '/', '', true, true);

D. setcookie('session', 'active', time() + 604800, '/', '', true, false);

Solution

1. Step 1: Calculate expiration time for 7 days

   7 days = 7 * 24 * 3600 = 604800 seconds, so time() + 604800 is correct.

2. Step 2: Set secure and httponly flags

   To make cookie HTTPS-only, set the secure flag to true. To improve security, httponly should also be true.

3. Step 3: Check options

   setcookie('session', 'active', time() + 604800, '/', '', true, true); sets secure and httponly to true, matching requirements. Others either disable secure or httponly or omit parameters.

4. Final Answer:

   setcookie('session', 'active', time() + 604800, '/', '', true, true); -> Option C

5. Quick Check:

   Secure and httponly true for HTTPS cookie = D [OK]

Hint: Use secure=true and httponly=true for HTTPS cookies [OK]

Common Mistakes:

• Not setting secure flag to true for HTTPS-only cookies
• Omitting httponly flag for security
• Incorrect expiration time calculation