PHP Cookie Management

Cookie management is deciding what the note says, how long it lasts, and who can read it. PHP can write, read, and tear up cookies when they are no longer needed.

In this page:

Introduction to Cookies
Setting Cookie Expiration
Cookie Security Options
Deleting Cookies
Checking if Cookies are Enabled

Syntax

php

setcookie("name", "value", [
    "expires"  => time() + seconds,
    "path"     => "/",
    "secure"   => true,
    "httponly" => true,
]);

setcookie("name", "", time() - 3600);   // delete

Introduction to Cookies

setcookie() is the function that actually creates a cookie on the visitor's machine; it takes the cookie's name and value plus optional settings that control its lifetime, scope, and security.

Example: Introduction to Cookies

php

<?php
// Call `setcookie("username", "Alice")`
setcookie("username", "Alice");
// Print "Cookie created with a name and value" to the output
echo "Cookie created with a name and value";
?>

Setting Cookie Expiration

If you don't pass an expiration time to setcookie(), the cookie is treated as a session cookie and disappears the moment the browser closes -- explicitly setting a future timestamp is what makes data persist across visits.

Example: Setting Cookie Expiration

php

<?php
setcookie("username", "Alice"); // session cookie -- disappears when browser closes
setcookie("remembered_user", "Alice", time() + 86400); // persists for 1 day
echo "Two cookies set with different lifetimes";
?>

Cookie Security Options

Marking a cookie HttpOnly stops client-side scripts from reading it (blocking a common XSS attack path), while marking it Secure ensures the browser only ever transmits it over an encrypted HTTPS connection.

Example: Cookie Security Options

php

<?php
// Call `setcookie("token", "abc123", ['httponly' => true, 'secure' => true])`
setcookie("token", "abc123", ['httponly' => true, 'secure' => true]);
// Print "HttpOnly blocks JS access; Secure requires HTTPS" to the output
echo "HttpOnly blocks JS access; Secure requires HTTPS";
?>

Deleting Cookies

Setting a cookie's expiration to a timestamp in the past is the standard way to delete it, since there's no dedicated delete function -- the browser sees the expired date and discards the cookie on its next check.

Example: Deleting Cookies

php

<?php
// Call `setcookie("username", "", time() - 3600)`
setcookie("username", "", time() - 3600);
// Print "Expiration set in the past -- cookie will be discarded" to the output
echo "Expiration set in the past -- cookie will be discarded";
?>

Checking if Cookies are Enabled

You can test cookie support by setting a throwaway cookie on one page load and checking for its presence on the next; if it's missing, the visitor's browser likely has cookies disabled or blocked.

Example: Checking if Cookies are Enabled

php

<?php
// Call `setcookie("test_cookie", "1")`
setcookie("test_cookie", "1");
// Check whether `isset($_COOKIE['test_cookie'])`
if (isset($_COOKIE['test_cookie'])) {
    // Print "Cookies are enabled" to the output
    echo "Cookies are enabled";
// Otherwise, run this branch
} else {
    // Print "Cookies may be disabled -- check on next page load" to the output
    echo "Cookies may be disabled -- check on next page load";
}
?>

Chapter Quiz — Complete all 5 topics to unlock

0/5 topics done

Complete these topics first:

← Previous Lesson PHP Cookies Introduction Next Lesson → PHP Authentication Basics