Learn PHP Programming

<?php
// Must be called before ANY output (including whitespace)
session_start();

// Setting session variables
$_SESSION['username'] = 'alice';
$_SESSION['role'] = 'admin';
$_SESSION['login_time'] = time();

// Reading session variables
echo "Hello, " . htmlspecialchars($_SESSION['username']);
echo "Role: " . $_SESSION['role'];

// Check if a session variable exists
if (isset($_SESSION['username'])) {
    echo 'User is logged in';
}

// Remove a specific session variable
unset($_SESSION['role']);

// Destroy the entire session
session_unset();      // Clear all session variables
session_destroy();    // Destroy the session file
?>

<?php
session_start();

// --- LOGIN (login.php) ---
function loginUser(string $username, string $password): bool {
    // Fetch user from database (pseudo-code)
    $user = getUserByUsername($username);

    if ($user && password_verify($password, $user['password_hash'])) {
        // Regenerate ID to prevent session fixation
        session_regenerate_id(true);

        $_SESSION['user_id']    = $user['id'];
        $_SESSION['username']   = $user['username'];
        $_SESSION['logged_in']  = true;
        $_SESSION['ip_address'] = $_SERVER['REMOTE_ADDR'];
        $_SESSION['last_activity'] = time();
        return true;
    }
    return false;
}

// --- PROTECTED PAGE (dashboard.php) ---
function requireAuth(): void {
    if (empty($_SESSION['logged_in'])) {
        header('Location: login.php');
        exit;
    }
    // Check session timeout (30 minutes)
    if (time() - $_SESSION['last_activity'] > 1800) {
        session_unset();
        session_destroy();
        header('Location: login.php?expired=1');
        exit;
    }
    $_SESSION['last_activity'] = time(); // Refresh timer
}

// --- LOGOUT (logout.php) ---
function logoutUser(): void {
    $_SESSION = []; // Clear data

    // Delete session cookie
    if (ini_get('session.use_cookies')) {
        $params = session_get_cookie_params();
        setcookie(session_name(), '', time() - 42000,
            $params['path'], $params['domain'],
            $params['secure'], $params['httponly']
        );
    }

    session_destroy();
    header('Location: login.php');
    exit;
}
?>

<?php
// Modern cookie syntax (PHP 7.3+) with options array
setcookie('preferences', json_encode(['theme' => 'dark', 'lang' => 'en']), [
    'expires'  => time() + (86400 * 30),  // 30 days
    'path'     => '/',                     // Available on all pages
    'domain'   => '',                       // Current domain only
    'secure'   => true,                     // HTTPS only
    'httponly'  => true,                     // Not accessible via JavaScript
    'samesite' => 'Lax'                     // CSRF protection
]);

// "Remember me" token (use a separate secure token, NOT the password)
$rememberToken = bin2hex(random_bytes(32));
setcookie('remember_token', $rememberToken, [
    'expires'  => time() + (86400 * 90),  // 90 days
    'path'     => '/',
    'secure'   => true,
    'httponly'  => true,
    'samesite' => 'Strict'
]);
// Store hashed token in database for verification

// Delete a cookie
setcookie('preferences', '', [
    'expires' => time() - 3600,
    'path'    => '/'
]);
?>

<?php
// Cookies are available on the NEXT request after being set
// Always validate and provide defaults

// Reading with null coalescing
$theme = $_COOKIE['theme'] ?? 'light';

// Reading JSON cookie safely
$prefs = [];
if (isset($_COOKIE['preferences'])) {
    $decoded = json_decode($_COOKIE['preferences'], true);
    if (json_last_error() === JSON_ERROR_NONE) {
        $prefs = $decoded;
    }
}

// Check remember-me cookie for auto-login
if (!isset($_SESSION['logged_in']) && isset($_COOKIE['remember_token'])) {
    $token = $_COOKIE['remember_token'];
    // Look up token in database, verify it's valid and not expired
    $user = findUserByRememberToken(hash('sha256', $token));
    if ($user) {
        session_regenerate_id(true);
        $_SESSION['user_id'] = $user['id'];
        $_SESSION['logged_in'] = true;
    }
}
?>