‫Okay, so cookies play a significant role in web development and user experience.
‫They allow you to store data on a user's device, making it accessible between different page visits
‫or sessions.
‫In PHP, you can work with cookies using the cookies superglobal.
‫And in this lesson I'm going to explain what that cookie superglobal is, how to set and retrieve cookies.
‫And and we'll go from there.
‫So the cookies are sent with Http requests, allowing the server to remember information about the user.
‫Now, you never want to put sensitive information in a cookie, like a password or a credit card info
‫or anything like that.
‫It's more for things like the user's name if you want to greet them when they come back to the site,
‫just stuff that really doesn't matter if other people see it.
‫Because cookies, unlike sessions, are stored on the client, okay, they're stored in the browser
‫and you can easily find them if you have more.
‫If you have something that's more sensitive that you need to save, then you want to do that server
‫side.
‫All right.
‫So let's just talk a little bit about where cookies and sessions differ.
‫So the storage location obviously I said cookies are stored on the client and sessions are stored on
‫the server.
‫Data persistent.
‫So cookies can be set with an expiration time allowing data to persist on the client beyond the current
‫session.
‫Essentially you can have a cookie last forever.
‫It's not a good idea, but you can in session.
‫Data usually only exists for the duration of a user's visit to to that website.
‫So you'll use sessions for like a login system.
‫And we're going to get to that when we get to our project security.
‫So cookies can be less secure, obviously, because they're stored on the client and they can be tampered
‫with.
‫Sessions are generally more secure because that data is stored on the server and it's not accessible
‫or modifiable by the client.
‫However, session hijacking can be a security concern.
‫If not properly protected, then we have storage capacity.
‫So cookies have a limited storage capacity, and that makes them suitable for small amounts of data
‫like user preferences or tokens.
‫And then sessions can store larger amounts of data on the server, even though storing excessive data
‫in sessions can impact server resources.
‫Ease of use cookies are easy to work with and don't require server side scripting.
‫Data retrieval is straightforward on the client side sessions often require well, pretty much always
‫require server side scripting to create, manage, and destroy.
‫Working with sessions can be a bit more complex, especially with large applications.
‫Cross tab communication cookies can be accessed from different tabs or windows, allowing data sharing
‫with within the same domain.
‫Sessions are generally isolated to a single tab or window.
‫Communication between different tabs or windows within the same session can be a little bit challenging
‫at times, and then use cases.
‫Cookies are often used for authentication tokens, remembering user preferences, tracking user behavior,
‫things like that, and sessions are commonly used for server side authentication, storing temporary
‫data during a user's visit, things like that.
‫So when you create a login system with PHP, you're you're probably going to be using sessions unless
‫you're using some third party solution.
‫All right.
‫So enough talk.
‫Let's jump in.
‫And I'm going to show you how to create cookies.
‫Now you can see the cookies that are set for that domain.
‫If you go to the dev tools here and you go to application and you go down to cookies, you can see that
‫there's none set right now.
‫So there's three pages in the starter files, this index page page dot PHP and destroy dot PHP.
‫So in the index page I'm going to create a cookie.
‫So let's go up to the top here.
‫And let's open and close our PHP tags.
‫And then the function that we use is called set cookie.
‫Now this takes in a bunch of different arguments or parameters.
‫So if we look at this this pop up the first thing you want to pass in is the name of the cookie which
‫you can call whatever you want.
‫Secondly is the value.
‫Then we have the expiration.
‫And and that's optional.
‫You don't have to add an expiration.
‫The path actually everything after this is optional.
‫You really just need the name and the value the path.
‫So generally you'll set that to just slash because you want it to be accessible throughout the whole
‫domain.
‫And then the actual domain you can set secure.
‫So if secure is set to true then the cookie will only be set if it's a secure.
‫Action if it's Https all right, and then http only when true, the cookie will be made accessible only
‫through the Http protocol.
‫So this means that the cookie won't be accessible by scripting languages like JavaScript, which can
‫mitigate attacks such as cross-site scripting.
‫So it's a generally a safe way to to use cookies if you if your the functionality, you know allows
‫that.
‫So let's set a cookie for the name I'm going to call it username.
‫And then for the value I'll say jdoe.
‫And then I want to set an expiration.
‫You should do this.
‫It's just it's just good practice.
‫And it's a little confusing because you can't just say like one day or something like that.
‫It's the time.
‫So it's a Unix timestamp.
‫So it's the number of seconds since the epoch which is like January 1st, 1970.
‫So it says in other words, you'll most likely set this with the time function plus the number of seconds
‫before you want it to expire.
‫Okay.
‫So there's a few ways you could handle this.
‫If we want to set this to an hour from now, we could say time.
‫So the current time plus 3600 seconds.
‫So that should be an hour.
‫All right.
‫And then for the path usually you're just going to put slash in there the root domain or the root path.
‫So that should set the cookie.
‫So I'm going to save that and then reload the page.
‫And now you'll see down in the dev tools we have username jdoe.
‫And you can see how easy it is to see that data.
‫So that's why you know you don't store sensitive data in a cookie.
‫Now to get the cookie, let's go to page dot PHP and there's a link here to go to page dot PHP.
‫And right now it's just a link to delete it.
‫But I want to show the cookie here.
‫So let's go up top.
‫Open up our PHP tags and then I'll create a variable called username.
‫And I want to put the value that's in that cookie into this username variable.
‫So this is where the superglobal comes in.
‫We can say cookie.
‫And actually before we do that let's just do a var dump.
‫Of underscore.
‫Cookie.
‫So if we do that, you'll see that it's just an array that has the cookie name as the key and then the
‫value.
‫So again we can just set username to cookie and then whatever the key is or the name.
‫And what I'll do here is because you always want to check to see if it's there, I'll use the null coalescing
‫operator and I'll put in guest if that value isn't there.
‫And then down below let's go right above the delete.
‫And let's have an H one.
‫And we'll say welcome.
‫And then we'll just output.
‫Oops.
‫We'll just output the username.
‫Whether that's guest or the actual name.
‫So if I reload we see welcome J Doe.
‫All right now to delete the cookie.
‫So if I click on this it brings me to the destroy dot PHP which right now doesn't do anything.
‫It says your cookie has been deleted, but it hasn't.
‫If we go back to page dot php, you can see j dot is still there.
‫So what we need to do to delete the cookie is use the set cookie function again.
‫So set cookie and the name that we want to delete.
‫So username.
‫And then what we want to set it to which is just going to be empty.
‫And we basically want it.
‫We want to set the expire to a time that is before now.
‫So what we can do is use the time function.
‫And then we can -3600 seconds okay.
‫And then the path which is just slash.
‫So deleting the cookie is very similar to saving it, except you want to set it to a time that's before
‫the current time.
‫So now if I go ahead and I reload the destroy dot php, it says your cookie has been deleted.
‫If I go back to page dot PHP now it says welcome guest because now the cookie isn't set.
‫If I go back to index.php.
‫Which is actually.
‫Let me just.
‫Go to the index.php.
‫Now the cookie got set again.
‫And you can see right down here that it's set.
‫If I go to page dot php it's set jdo.
‫If I click delete now it's gone.
‫You can see down here it went away.
‫And if I go back to page PHP we get guest instead of jdo.
‫So that's the very, very basic fundamentals of creating and destroying cookies.
‫So now that we've gone through pretty much all the super globals, what I want to do in the next section
‫is start to get into working with a database.
‫We're going to work with a MySQL database.
‫We're going to use something called PDO.