Session vs cookie decision in PHP - Visual Side-by-Side Comparison

Concept Flow - Session vs cookie decision

Start

↓

Need to store user data?

↓

No storage needed

→End

Yes↓

Is data sensitive?

↓

Use Session (server-side)

→End

No↓

Need data to persist after browser closes?

↓

Use Cookie (client-side)

→End

No↓

Use Session (temporary, server-side)

→End

Decide whether to use session or cookie by checking if data is sensitive and how long it should persist.

Execution Sample

PHP

<?php
session_start();
if ($isSensitive) {
  $_SESSION['user'] = $userData;
} else {
  setcookie('user', $userData, time() + 3600);
}
?>

Stores user data in session if sensitive, otherwise in a cookie for 1 hour.

Execution Table

Step	Condition Checked	Condition Result	Action Taken	Storage Type
1	Need to store user data?	Yes	Check if data is sensitive	None yet
2	Is data sensitive?	Yes	Store in session	Session (server-side)
3	End	-	Data stored securely on server	Session (server-side)

💡 Data stored securely in session because it is sensitive.

Variable Tracker

Variable	Start	After Step 2	Final
$isSensitive	true	true	true
$_SESSION['user']	unset	set to userData	set to userData
setcookie('user')	unset	not set	not set

Key Moments - 2 Insights

Why do we use session for sensitive data instead of cookies?

Sessions store data on the server, so sensitive info is not exposed to the user, as shown in execution_table step 2.

What happens if data is not sensitive and needs to persist after browser closes?

Cookies are used because they stay on the client even after closing the browser, unlike sessions which end, as explained in concept_flow.

Visual Quiz - 3 Questions

Look at the execution_table, what storage type is chosen when data is sensitive?

A Session (server-side)

B Cookie (client-side)

C Local storage

D No storage

💡 Hint

Check execution_table row 2 under 'Storage Type'

At which step does the program decide to store data in session?

A Step 1

B Step 2

C Step 3

D No step

💡 Hint

Look at execution_table 'Action Taken' column for step 2

If $isSensitive was false and data should persist after browser closes, what would change?

A Data stored in session

B Data stored in cookie

C No data stored

D Data stored in local storage

💡 Hint

Refer to concept_flow decision after 'Is data sensitive?' and 'Need data to persist after browser closes?'

Concept Snapshot

Session vs Cookie Decision:
- Use session for sensitive data (stored server-side).
- Use cookie for non-sensitive data needing persistence after browser closes.
- Sessions expire when browser closes; cookies can last longer.
- Sessions keep data hidden from user; cookies are stored on user device.
- Choose based on sensitivity and persistence needs.

Full Transcript

This visual execution shows how to decide between using sessions and cookies in PHP. First, check if you need to store user data. If yes, check if the data is sensitive. Sensitive data should be stored in sessions because sessions keep data on the server, protecting it from user access. If data is not sensitive and needs to persist after the browser closes, use cookies because they stay on the user's device. The example code stores user data in session if sensitive, otherwise in a cookie for one hour. The execution table traces these decisions step-by-step, showing when and where data is stored. Key moments clarify why sessions protect sensitive data and when cookies are better for persistence. The quiz tests understanding of these decisions based on the visual trace.

Practice

1. Which of the following is the best reason to use a PHP session instead of a cookie?

easy

A. To reduce server memory usage

B. To save user preferences permanently on the browser

C. To store sensitive user data temporarily during a visit

D. To share data between different websites

Solution

1. Step 1: Understand session purpose

   Sessions store data on the server and are good for sensitive or temporary data during a visit.

2. Step 2: Compare with cookies

   Cookies store data on the user's browser and are better for non-sensitive, longer-term data.

3. Final Answer:

   To store sensitive user data temporarily during a visit -> Option C

4. Quick Check:

   Session = temporary sensitive data [OK]

Hint: Use sessions for sensitive, temporary data; cookies for long-term [OK]

Common Mistakes:

• Thinking cookies are safer than sessions
• Using sessions to store permanent data
• Confusing where data is stored

2. Which PHP code snippet correctly starts a session?

easy

A.

B.

C.

D.

Solution

1. Step 1: Recall PHP session syntax

   The correct function to start a session is session_start().

2. Step 2: Check other options

   Other options are not valid PHP functions and will cause errors.

3. Final Answer:

   <?php session_start(); ?> -> Option D

4. Quick Check:

   session_start() starts session [OK]

Hint: Remember exact function name: session_start() [OK]

Common Mistakes:

• Using incorrect function names
• Forgetting parentheses
• Confusing session_start with cookie functions

3. What will be the output of this PHP code?

<?php
session_start();
$_SESSION['user'] = 'Alice';
setcookie('user', 'Bob', time() + 3600);
echo $_SESSION['user'] . ' & ' . $_COOKIE['user'];
?>

medium

A. Alice &

B. Bob & Alice

C. Alice & Alice

D. Bob & Bob

Solution

1. Step 1: Understand session and cookie values

   $_SESSION['user'] is set to 'Alice'. The cookie 'user' is set to 'Bob' but will be available on the next request only.

2. Step 2: Check echo output

   $_SESSION['user'] outputs 'Alice'. $_COOKIE['user'] is not set in this request (assuming no prior cookie), so it is empty. Output: Alice & (empty).

3. Final Answer:

   Alice & -> Option A

4. Quick Check:

   Session = Alice immediate, Cookie = next request [OK]

Hint: Session changes immediate; cookie available next request [OK]

Common Mistakes:

• Expecting cookie value immediately after setcookie()
• Mixing session and cookie values
• Assuming cookie overwrites session

4. Identify the error in this PHP code snippet:

<?php
setcookie('theme', 'dark');
session_start();
$_SESSION['theme'] = 'light';
?>

medium

A. session_start() must be called before setcookie()

B. No error, code is correct

C. $_SESSION cannot be set after setcookie()

D. setcookie() must be called before any output

Solution

1. Step 1: Recall header rules in PHP

   Both setcookie() and session_start() send HTTP headers and must be called before any output.

2. Step 2: Check order and output

   No output before either function. Order of setcookie() before session_start() is fine; multiple Set-Cookie headers are allowed.

3. Final Answer:

   No error, code is correct -> Option B

4. Quick Check:

   Headers before output, order OK [OK]

Hint: Call setcookie() and session_start() before any output [OK]

Common Mistakes:

• Thinking session_start() must come before setcookie()
• Ignoring header output rules
• Assuming $_SESSION depends on setcookie()

5. You want to remember a user's language preference safely for their entire visit but not after they close the browser. Which is the best choice?

hard

A. Store language in a session variable

B. Store language in a cookie with 1 year expiry

C. Store language in a cookie without expiry

D. Store language in a hidden form field

Solution

1. Step 1: Understand data lifetime needs

   The language preference should last only during the visit, not after browser closes.

2. Step 2: Match storage type to lifetime

   Sessions last until browser closes or session expires, so session variable fits. Cookies persist beyond browser close if expiry is set.

3. Final Answer:

   Store language in a session variable -> Option A

4. Quick Check:

   Temporary visit data = session [OK]

Hint: Use session for visit-only data, cookie for longer storage [OK]

Common Mistakes:

• Using cookies for temporary visit data
• Setting cookie without expiry expecting session behavior
• Using hidden fields for persistent data