$_SESSION

Every request to a PHP script starts fresh. Variables from the previous page are gone. $_SESSION solves that: it is an array that PHP keeps on the server for each visitor between requests.

1
2
3
4

<?php
session_start();   // must come before using $_SESSION

$_SESSION["user_name"] = "Isha";

On the next page:

1
2
3
4

<?php
session_start();

echo "Welcome back, " . htmlspecialchars($_SESSION["user_name"] ?? "guest");

How it works

1. session_start() checks whether the browser sent a session ID cookie.
2. If not, PHP creates a new session and sends the ID to the browser as a cookie.
3. PHP loads the saved data for that ID into $_SESSION.
4. When the script ends, PHP saves the changes.

The visitor’s browser only holds the ID. The data lives on the server, so it cannot be changed by the visitor.

What to store

• The ID of the logged-in user (not the whole user record or the password).
• A shopping cart, a CSRF token, a flash message.
• Small things. Sessions are stored per visitor, and large sessions slow everything down.

Rules

1. Call session_start() before any output, because it sends a cookie header.
2. Call it on every page that uses $_SESSION.
3. Never put secrets such as passwords in the session. Store the user’s ID, and load the rest from the database when needed.

Reading safely

1
2
3
4
5
6

<?php
$_SESSION = [];   // pretend a new, empty session

$name = $_SESSION["user_name"] ?? "guest";

echo $name;

1

guest

Chapter 16 covers everything about sessions: What Is a Session?, secure session practices and logging out.