Session vs cookie decision in PHP - Hands-On Comparison

Session vs Cookie Decision in PHP

📖 Scenario: You are building a simple PHP web application that needs to remember user preferences. You want to decide whether to use sessions or cookies to store this information.

🎯 Goal: Create a PHP script that stores a user preference using a session or a cookie based on a configuration variable. Then display the stored preference.

📋 What You'll Learn

Create an array called userPreferences with keys 'theme' and 'fontSize' and values 'dark' and 'medium' respectively.

Create a boolean variable called useSession and set it to true or false to decide storage method.

Write code that stores the userPreferences in a session if useSession is true, or in cookies if useSession is false.

Write code that retrieves and prints the stored preferences from the session or cookies.

💡 Why This Matters

🌍 Real World

Web applications often need to remember user settings like themes or font sizes. Sessions and cookies are common ways to store this information.

💼 Career

Understanding sessions and cookies is essential for web developers to manage user data securely and efficiently.

1

Create the user preferences array

Create an array called userPreferences with these exact entries: 'theme' => 'dark' and 'fontSize' => 'medium'.

PHP

 'dark' and 'fontSize' => 'medium'
// Your code here

Hint

Use PHP array syntax with square brackets and key => value pairs.

2

Add the storage method configuration

Create a boolean variable called useSession and set it to true.

PHP

 'dark', 'fontSize' => 'medium'];

// Create a boolean variable useSession and set it to true
// Your code here

Hint

Use = true; to assign the boolean value.

3

Store preferences using session or cookie

Write code that starts the session with session_start(). Then, if useSession is true, store userPreferences in $_SESSION['prefs']. Otherwise, store each preference in a cookie using setcookie() with keys 'theme' and 'fontSize' and expiry time 1 hour from now.

PHP

 'dark', 'fontSize' => 'medium'];

$useSession = true;

// Start session and store preferences in session or cookies based on useSession
// Your code here

Hint

Remember to call session_start() before using $_SESSION.

4

Retrieve and display stored preferences

Write code that starts the session with session_start(). Then, if useSession is true, retrieve preferences from $_SESSION['prefs']. Otherwise, retrieve preferences from $_COOKIE['theme'] and $_COOKIE['fontSize']. Finally, print the preferences in the format: Theme: [theme], Font Size: [fontSize].

PHP

 'dark', 'fontSize' => 'medium'];

$useSession = true;

session_start();

if ($useSession) {
    $_SESSION['prefs'] = $userPreferences;
} else {
    setcookie('theme', $userPreferences['theme'], time() + 3600);
    setcookie('fontSize', $userPreferences['fontSize'], time() + 3600);
}

// Retrieve and print stored preferences
// Your code here

Hint

Use print() with double quotes and curly braces to insert variables.

Practice

1. Which of the following is the best reason to use a PHP session instead of a cookie?

easy

A. To reduce server memory usage

B. To save user preferences permanently on the browser

C. To store sensitive user data temporarily during a visit

D. To share data between different websites

Solution

1. Step 1: Understand session purpose

   Sessions store data on the server and are good for sensitive or temporary data during a visit.

2. Step 2: Compare with cookies

   Cookies store data on the user's browser and are better for non-sensitive, longer-term data.

3. Final Answer:

   To store sensitive user data temporarily during a visit -> Option C

4. Quick Check:

   Session = temporary sensitive data [OK]

Hint: Use sessions for sensitive, temporary data; cookies for long-term [OK]

Common Mistakes:

• Thinking cookies are safer than sessions
• Using sessions to store permanent data
• Confusing where data is stored

2. Which PHP code snippet correctly starts a session?

easy

A.

B.

C.

D.

Solution

1. Step 1: Recall PHP session syntax

   The correct function to start a session is session_start().

2. Step 2: Check other options

   Other options are not valid PHP functions and will cause errors.

3. Final Answer:

   <?php session_start(); ?> -> Option D

4. Quick Check:

   session_start() starts session [OK]

Hint: Remember exact function name: session_start() [OK]

Common Mistakes:

• Using incorrect function names
• Forgetting parentheses
• Confusing session_start with cookie functions

3. What will be the output of this PHP code?

<?php
session_start();
$_SESSION['user'] = 'Alice';
setcookie('user', 'Bob', time() + 3600);
echo $_SESSION['user'] . ' & ' . $_COOKIE['user'];
?>

medium

A. Alice &

B. Bob & Alice

C. Alice & Alice

D. Bob & Bob

Solution

1. Step 1: Understand session and cookie values

   $_SESSION['user'] is set to 'Alice'. The cookie 'user' is set to 'Bob' but will be available on the next request only.

2. Step 2: Check echo output

   $_SESSION['user'] outputs 'Alice'. $_COOKIE['user'] is not set in this request (assuming no prior cookie), so it is empty. Output: Alice & (empty).

3. Final Answer:

   Alice & -> Option A

4. Quick Check:

   Session = Alice immediate, Cookie = next request [OK]

Hint: Session changes immediate; cookie available next request [OK]

Common Mistakes:

• Expecting cookie value immediately after setcookie()
• Mixing session and cookie values
• Assuming cookie overwrites session

4. Identify the error in this PHP code snippet:

<?php
setcookie('theme', 'dark');
session_start();
$_SESSION['theme'] = 'light';
?>

medium

A. session_start() must be called before setcookie()

B. No error, code is correct

C. $_SESSION cannot be set after setcookie()

D. setcookie() must be called before any output

Solution

1. Step 1: Recall header rules in PHP

   Both setcookie() and session_start() send HTTP headers and must be called before any output.

2. Step 2: Check order and output

   No output before either function. Order of setcookie() before session_start() is fine; multiple Set-Cookie headers are allowed.

3. Final Answer:

   No error, code is correct -> Option B

4. Quick Check:

   Headers before output, order OK [OK]

Hint: Call setcookie() and session_start() before any output [OK]

Common Mistakes:

• Thinking session_start() must come before setcookie()
• Ignoring header output rules
• Assuming $_SESSION depends on setcookie()

5. You want to remember a user's language preference safely for their entire visit but not after they close the browser. Which is the best choice?

hard

A. Store language in a session variable

B. Store language in a cookie with 1 year expiry

C. Store language in a cookie without expiry

D. Store language in a hidden form field

Solution

1. Step 1: Understand data lifetime needs

   The language preference should last only during the visit, not after browser closes.

2. Step 2: Match storage type to lifetime

   Sessions last until browser closes or session expires, so session variable fits. Cookies persist beyond browser close if expiry is set.

3. Final Answer:

   Store language in a session variable -> Option A

4. Quick Check:

   Temporary visit data = session [OK]

Hint: Use session for visit-only data, cookie for longer storage [OK]

Common Mistakes:

• Using cookies for temporary visit data
• Setting cookie without expiry expecting session behavior
• Using hidden fields for persistent data