Sessions

Introduction

Cookies are useful, but storing sensitive data directly in the browser is risky — a visitor can view or edit anything a cookie holds. PHP sessions solve this by keeping the actual data safely on the server, and using just a single small cookie to identify which visitor's data belongs to which request.

This lesson covers how sessions work, how to start one with session_start(), how to store and retrieve values with $_SESSION, and how sessions compare to the cookies you learned about in the previous lesson.

What is a Session?

A session is a way to store data on the server that persists across multiple page requests from the same visitor. When a session starts, PHP generates a unique session ID, stores it in a cookie on the visitor's browser, and uses that ID to look up the matching data — stored server-side — on every later request.

Starting a Session

Before you can use $_SESSION, you must call session_start(). This must happen before any output is sent to the browser, just like setcookie(), because it involves sending an HTTP header behind the scenes.

<?php
session_start();
echo "Session started. ID: " . session_id();
?>

Session started. ID: 8f3ka92ldk3jf83nfk23

Storing and Reading Session Data

Once a session has started, $_SESSION behaves like a regular associative array. Anything you store in it on one page is automatically available on any other page during the same session, as long as session_start() runs first each time.

<?php
session_start();
$_SESSION["username"] = "rahul";
$_SESSION["logged_in"] = true;
echo "Session data saved.";
?>

<?php
session_start();
if (!empty($_SESSION["logged_in"])) {
    echo "Welcome back, " . htmlspecialchars($_SESSION["username"]) . "!";
} else {
    echo "You are not logged in.";
}
?>

Welcome back, rahul!

Ending a Session

To fully end a session — typically when a visitor logs out — clear its data with session_unset() and then destroy the session itself with session_destroy().

<?php
session_start();
$_SESSION = [];
session_unset();
session_destroy();
echo "You have been logged out.";
?>

You have been logged out.

Regenerating the Session ID

session_regenerate_id() replaces the current session ID with a new one while keeping the session's data intact. This is a simple but important security measure, typically called right after a visitor successfully logs in, to prevent an attacker from reusing a previously known session ID.

<?php
session_start();
// After verifying the visitor's login credentials:
session_regenerate_id(true);
$_SESSION["logged_in"] = true;
echo "Login successful, session ID refreshed.";
?>

Login successful, session ID refreshed.

Sessions vs Cookies

In practice, sessions actually rely on a cookie behind the scenes — the session ID itself. The key difference is that the meaningful data stays safely on the server rather than being exposed to the visitor.

Example: A Simple Login Flow

A small end-to-end example showing a session being started, populated on login, checked on a protected page, and cleared on logout.

<?php
session_start();

// Imagine credentials were already verified above.
$_SESSION["username"] = "rahul";
$_SESSION["logged_in"] = true;
session_regenerate_id(true);

echo "Logged in as " . $_SESSION["username"];
?>

<?php
session_start();
if (empty($_SESSION["logged_in"])) {
    echo "Please log in first.";
} else {
    echo "Dashboard for " . htmlspecialchars($_SESSION["username"]);
}
?>

Logged in as rahul
Dashboard for rahul

Common Mistakes

Best Practices

Frequently Asked Questions

Key Takeaways

Summary

Sessions give PHP a secure way to remember information about a visitor across multiple requests without exposing the actual data to their browser. A single session ID cookie is all that travels back and forth, while the meaningful data — like login state — stays safely on the server.

In this lesson, you learned how to start, use, end, and secure a session, and how sessions compare to the cookies from the previous lesson. Next, you will move on to working with dates and times in PHP.