User Sessions and the $_SESSION Superglobal

The Session Lifecycle: A High-Level View

Before we dive into the code, let's visualize the entire process. Remember the coat-check analogy? The server stores your belongings (session data) and gives you a ticket (session ID). This diagram illustrates that client-server interaction.

Our lesson today will focus on the PHP functions that make steps 2, 3, and 6 happen.

1. Starting a Session with session_start()

The first and most important function is session_start(). You must call this function at the beginning of any PHP script that needs to access session data.

When you call session_start(), PHP performs one of two actions:

1. If the user's browser sends a valid session ID cookie (usually named PHPSESSID), PHP finds the corresponding session data file on the server and loads its contents into the $_SESSION superglobal array.
2. If no session ID is found, PHP creates a new, unique session ID, prepares to send it to the browser as a cookie, and initializes an empty $_SESSION array.

Let's see this in action. The following video demonstrates how calling session_start() generates the PHPSESSID cookie, which you can see in your browser's developer tools.

2. A Critical Rule: Headers and session_start()

There is one golden rule you must always remember: session_start() must be called before any output is sent to the browser.

Output includes:

• HTML tags (even a single space or doctype declaration before <?php)
• echo or print statements
• Whitespace outside of <?php ... ?> tags in included files.

Why? Because session_start() needs to send the Set-Cookie HTTP header to the browser. Headers can only be sent before the main body of the response begins. If you try to call session_start() after even a single byte of content has been sent, PHP will issue a "Warning: session_start(): Cannot start session when headers already sent" error. This is a very common stumbling block for new PHP developers.

The following video provides an excellent, in-depth explanation of this issue and the related concept of output buffering. Understanding this will save you hours of debugging in the future.

Best Practice: To be safe, always place session_start() at the absolute top of your PHP files.

<?php
session_start(); // This should be the very first thing.

// The rest of your PHP code...
?>
<!DOCTYPE html>
<html>
<!-- Your HTML... -->
</html>

3. Storing and Accessing Data with $_SESSION

Once a session is started, you can store and retrieve data using the $_SESSION superglobal array. It's a standard PHP associative array, so working with it is straightforward.

• To store data: $_SESSION['key'] = 'value';
• To retrieve data: $variable = $_SESSION['key'];

The beauty of this is that any data you store in $_SESSION on one page will be available on any other page within your application, as long as you call session_start() on that page too.

This next video segment demonstrates this cross-page data persistence.

Here is a simple, self-contained example:

page1.php

<?php
// Start the session
session_start();

// Store user information
$_SESSION['username'] = 'Alex';
$_SESSION['user_id'] = 123;

echo 'Hello, ' . $_SESSION['username'] . '. Your session is set.';
echo '<br><a href="page2.php">Go to Page 2</a>';
?>

page2.php

<?php
// Resume the session
session_start();

// Check if the user data exists before using it
if (isset($_SESSION['username'])) {
    echo 'Welcome back, ' . $_SESSION['username'] . '!';
    echo '<br>Your user ID is: ' . $_SESSION['user_id'];
    echo '<br><a href="logout.php">Logout</a>';
} else {
    echo 'You are not logged in.';
    echo '<br><a href="page1.php">Login</a>';
}
?>

Using isset() is important to avoid errors if you try to access a session variable that hasn't been set (e.g., if a user visits page2.php directly without "logging in" on page1.php).

4. Modifying and Ending a Session

Managing a session also involves changing and removing data.

Removing a Single Item

To remove a specific variable from the session, use the unset() function, just as you would with any array element.

// Removes the 'username' key and its value from the session
unset($_SESSION['username']);

Destroying the Entire Session

When a user logs out, you need to completely end their session. This is a two-step process for best results:

1. session_unset(): This function clears all data from the $_SESSION array.
2. session_destroy(): This function destroys all of the data associated with the current session on the server. It removes the session file itself.

The following video covers unset(), session_unset(), and session_destroy(), and highlights a very important quirk about how session_destroy() works.

Here's how you would typically implement a logout.php file:

logout.php

<?php
session_start(); // Resume the session

// 1. Unset all session variables
$_SESSION = []; // A more robust way than session_unset()

// 2. Destroy the session cookie (optional but good practice)
if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
    );
}

// 3. Finally, destroy the session on the server
session_destroy();

// Redirect to a public page
header('Location: page1.php');
exit;
?>

Note: The code to delete the cookie is more advanced and we will cover cookies in detail in the next lesson. The crucial part for now is session_destroy().

Finally, a quick but important warning from the official PHP manual: do not use unset($_SESSION). This will break the $_SESSION superglobal and you will no longer be able to store data in it. Always unset individual keys or clear the array with $_SESSION = [];.

Conclusion

You now have the practical tools to manage user state in PHP. By combining session_start() with the $_SESSION superglobal, you can create seamless, multi-page experiences for your users, from remembering their login status to managing a shopping cart.

Key Takeaways:

• Always call session_start() at the very top of any script that needs session access.
• Be vigilant about the "headers already sent" error; it means you have output before session_start().
• Store and retrieve data using the $_SESSION associative array (e.g., $_SESSION['user_id'] = 123;).
• Always check for session data with isset() before using it to prevent errors.
• Use unset($_SESSION['key']) to remove a specific item.
• Use session_destroy() to end a session completely, typically during a logout process.

Preview of the Next Lesson:
We've seen that PHP sessions use a cookie behind the scenes to store the session ID. But what if we want to manage cookies directly? In the next lesson, we will learn how to set, read, and delete cookies using PHP functions. This will enable us to implement features like a "Remember Me" checkbox on a login form.