Managing Cookies with PHP

Recap: The Role of the Session Cookie

As a quick refresher, let's look at the diagram we saw previously. It shows how the server sends a session ID in a Set-Cookie header, and the browser sends it back on subsequent requests. This is the fundamental mechanism that makes sessions work.

While PHP handles this session cookie automatically, we can create and manage our own cookies for other purposes.

1. What Are Cookies and Why Use Them?

A cookie is a small piece of text-based data that a web server asks the browser to store. When the browser requests a page from that same server in the future, it sends the cookie data back.

Watch this short video segment to understand the three primary purposes of cookies.

As the video explained, cookies are great for non-sensitive data that enhances the user experience. However, because they are stored and can be read on the client's machine, you should never store sensitive information like passwords or personal identifiers in a cookie.

2. Setting a Cookie with setcookie()

The primary function for managing cookies in PHP is setcookie(). It's used to create, modify, and delete cookies.

A crucial point to remember from our last lesson applies here as well: setcookie() sends an HTTP header and must be called before any output is sent to the browser. This includes HTML, echo statements, or even whitespace before your <?php tag.

The setcookie() Parameters

The setcookie() function has a number of parameters, but the first three are the most important for basic use.

setcookie(name, value, expires_or_options, path, domain, secure, httponly)

For a complete and authoritative definition of every parameter, the official PHP manual is the best resource. You don't need to read it all now, but it's good to know where to find it.

3. Reading and Deleting Cookies

Now that you know how to set a cookie, let's see how to read it back and then get rid of it.

Let's summarize the key actions:

Reading with $_COOKIE

You can access cookies sent by the browser using the $_COOKIE superglobal associative array.

// Check if a cookie named 'theme' has been sent by the browser
if (isset($_COOKIE['theme'])) {
    $userTheme = $_COOKIE['theme'];
    echo "Your saved theme is: " . htmlspecialchars($userTheme);
} else {
    echo "You don't have a theme preference saved.";
}

Important: The $_COOKIE array is populated at the start of the script. It contains cookies from the previous request. A cookie set with setcookie() in the current script will not be available in $_COOKIE until the next time the user loads a page.

Deleting a Cookie

As the video showed, to delete a cookie, you call setcookie() with the same name, but with an expiration date in the past.

// To delete the 'theme' cookie, set its expiration to one hour ago
setcookie('theme', '', time() - 3600, '/'); 

It's good practice to set the value to an empty string and include the same path you used when creating it to ensure it's properly removed.

4. Securing Your Cookies

Given your interest in cybersecurity, this part is especially relevant. Improperly configured cookies can open your application to attacks. The two most important flags for securing cookies are secure and httponly.

• secure flag: Ensures the cookie is only ever transmitted over an encrypted HTTPS connection. This prevents attackers from sniffing the cookie data on an insecure network (like public Wi-Fi).
• httponly flag: Prevents the cookie from being accessed by client-side JavaScript (document.cookie). This is a critical defense against Cross-Site Scripting (XSS) attacks, where an attacker might inject malicious script to steal a user's session cookie.

This image clearly illustrates the goal of an HttpOnly cookie.

The following article provides a concise guide on these security practices.

So, a securely set cookie would look like this, using all the parameters:

<?php
$cookie_name = "user_preference";
$cookie_value = "dark_mode";
$expiry_time = time() + (86400 * 30); // 30 days
$path = "/";
$domain = "yourdomain.com"; // Be specific where possible
$is_secure = true; // For HTTPS only
$is_http_only = true; // Prevent JS access

setcookie(
    $cookie_name, 
    $cookie_value, 
    $expiry_time, 
    $path, 
    $domain, 
    $is_secure, 
    $is_http_only
);

echo "Secure cookie has been set!";
?>

Conclusion

You now have a solid foundation for working with cookies in PHP. You can create them to store user preferences, read them back to personalize the user experience, and delete them when they are no longer needed. Most importantly, you know how to do so securely.

Key Takeaways:

• Cookies are small pieces of data stored on the client's browser, ideal for non-sensitive information.
• The setcookie() function is used to create, update, and delete cookies. It must be called before any browser output.
• The $_COOKIE superglobal array is used to read cookie data sent by the browser. It reflects the state from the previous page load.
• To delete a cookie, you call setcookie() with an expiration time in the past.
• For security, always consider using the secure (for HTTPS) and httponly (to block JavaScript access) flags.

Preview of the Next Lesson:
We've now thoroughly covered both server-side sessions and client-side cookies. With these two powerful tools for state management in our toolkit, we are perfectly prepared for the next step: building a user registration system with secure password handling. We will see how sessions are used to manage a user's logged-in state and how cookies could be used to implement a "Remember Me" feature.