Unit 4: Cookies, sessions and advanced techniques

php<?php
// set: name, value, expiry (30 days), path
setcookie("theme", "dark", time() + 30 * 24 * 60 * 60, "/");
// read (available from the next request)
echo $_COOKIE["theme"] ?? "light";
// delete: set expiry in the past
setcookie("theme", "", time() - 3600, "/");
?>

• setcookie() must be called before any HTML output, because cookies travel in HTTP headers.

php<?php
// login.php
session_start();
if ($user_ok) {
    session_regenerate_id(true);     // prevent session fixation
    $_SESSION["user"] = $username;
    $_SESSION["role"] = "student";
    header("Location: dashboard.php");
}

// dashboard.php
session_start();
if (!isset($_SESSION["user"])) { header("Location: login.php"); exit; }
echo "Welcome " . $_SESSION["user"];

// logout.php
session_start();
$_SESSION = [];                      // clear variables
session_destroy();                   // end the session
?>

HTTP is stateless — each request is independent — so websites use cookies and sessions to remember users.

php<?php
session_start();
$_SESSION["user"] = "ana";      // store
echo $_SESSION["user"];         // read on any page after session_start()
session_destroy();              // logout
?>

• PHP stores session data as a serialised string; session_encode() returns that string for the current session and session_decode() restores variables from such a string.

php<?php
session_start();
$_SESSION["user"] = "aman";
$_SESSION["cart"] = 3;
$data = session_encode();      // user|s:4:"aman";cart|i:3;
session_decode($data);         // repopulates $_SESSION
// general-purpose alternatives: serialize()/unserialize(), json_encode()/json_decode()
?>

php<?php
$ftp = ftp_connect("ftp.example.com");
ftp_login($ftp, "user", "password");
ftp_put($ftp, "public_html/index.php", "index.php", FTP_BINARY);
ftp_close($ftp);
?>

php<!-- form -->
<form method="post" enctype="multipart/form-data">
  <input type="file" name="photo"> <button>Upload</button>
</form>
<?php
if (isset($_FILES["photo"]) && $_FILES["photo"]["error"] === 0) {
    $allowed = ["jpg", "jpeg", "png"];
    $ext = strtolower(pathinfo($_FILES["photo"]["name"], PATHINFO_EXTENSION));
    if (!in_array($ext, $allowed))            echo "Only JPG or PNG allowed";
    elseif ($_FILES["photo"]["size"] > 2e6)    echo "Maximum 2 MB";
    else {
        $target = "uploads/" . uniqid() . "." . $ext;
        move_uploaded_file($_FILES["photo"]["tmp_name"], $target);
        echo "Uploaded";
    }
}
// download.php — force the browser to download a file
$file = "uploads/syllabus.pdf";
header("Content-Type: application/pdf");
header("Content-Disposition: attachment; filename=\"" . basename($file) . "\"");
header("Content-Length: " . filesize($file));
readfile($file);
?>

php<?php
$to = "student@example.com";
$subject = "Admission confirmed";
$message = "Dear student, your admission to B.Sc IT is confirmed.";
$headers = "From: admissions@example.com\r\nContent-Type: text/plain; charset=UTF-8";
if (mail($to, $subject, $message, $headers)) echo "Mail sent";
else echo "Mail failed";
?>

• mail() needs an SMTP server configured in php.ini; for authenticated SMTP, HTML mail and attachments, use PHPMailer or a mail API.

php<?php
error_reporting(E_ALL);           // report everything during development
ini_set("display_errors", 1);     // turn OFF on a live server; log instead

function divide($a, $b) {
    if ($b == 0) throw new Exception("Division by zero");
    return $a / $b;
}
try {
    echo divide(10, 0);
} catch (Exception $e) {
    error_log($e->getMessage());  // write to the log file
    echo "Something went wrong";
} finally {
    echo " — done";
}
?>

• Debugging aids: echo, var_dump(), print_r(), die(), error logs and Xdebug breakpoints.