Scribd
Upload
14 views26 pages

Cookies and Sessions

The document discusses how PHP addresses the statelessness of HTTP by using cookies and sessions to maintain user data persistence in web applications. It explains the differences between GET and POST methods for sending data, and provides examples of how to implement cookies and sessions in PHP. The conclusion emphasizes that both cookies and sessions are essential for creating dynamic web pages, with their use depending on client capabilities and data storage needs.

Uploaded by

antonymokwapa
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
14 views26 pages

Cookies and Sessions

The document discusses how PHP addresses the statelessness of HTTP by using cookies and sessions to maintain user data persistence in web applications. It explains the differences between GET and POST methods for sending data, and provides examples of how to implement cookies and sessions in PHP. The conclusion emphasizes that both cookies and sessions are essential for creating dynamic web pages, with their use depending on client capabilities and data storage needs.

Uploaded by

antonymokwapa
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 26

CSI315 – WEB TECHNOLOGY AND APPLICATIONS

Cookies and Sessions


Introduction
• In this lecture we are going to look at the ways PHP can
resolve the problem of HTTP’s statelessness.
– This is a necessary aspect of creating a dynamic web-based
application.

• Persistence of user data is tremendously important.


– No-one wants to have to login every time they perform an action on an
application.

• We will also discuss the ways in which our PHP scripts can
deal with incoming information from HTML pages and URL
queries.

2
Statelessness - 1
• The problem with HTTP as a delivery platform is that it is
stateless.
– The only data you have in the form is the data you take with you.

• Traditionally, this problem is solved by using cookies or


sessions.

3
Statelessness - 2
• HTTP permits the sending of data to web pages.
- This data is however not sent onto other pages due to the
statelessness of the protocol.
• Two methods for this are provided:
- GET
- POST
• When it is time to send information (for example, from form
elements), it is encoded by the client and then sent in one
of these two ways.

4
GET
• Using the GET method, the information that is encoded
gets sent as an extension to the URL.
- It will appear as something like:
http://<url>/dice_roll_get.php?num=6&faces=7
• This information is available to PHP via the $_GET
variable.
- The action used to provide data to a PHP form influences the code
that we use to access it.

• We can make use of the GET protocol by changing the


action in our form to GET.

5
Example Using GET - HTML

<html>
<head>
<title>Dice Form</title>
</head>
<body>
<form action = "dice_roll_get.php" method = "get">
<p>How many dice</p>
<input type = "text" name = "num">
<p>How many faces?</p>
<input type = "text" name = "faces">
<input type = "submit" value = "Roll">
<input type = "reset" value = "Clear values">
</body>
</html>

6
Example Using GET - PHP

<?php
$num = $_GET["num"];
$faces = $_GET["faces"];
$total = 0;
$roll = 0;

for ($i = 0; $i < $num; $i++) {


$roll = (rand()%$faces) + 1;
echo "<p>Dice roll " . ($i+1) . " is $roll.</p>";
$total += $roll;
}
echo "<p>Total roll is $total</p>"
?>

7
Overview of GET

• There are restrictions on how much information can be


sent using GET.
- And on the type of information.

• It can send a maximum of 1024 characters.


• It cannot send binary data, only alphanumeric characters.
• It should never be used to send sensitive data, such as
passwords.
- They get encoded into the URL.

8
Why Use GET?

• GET is a somewhat limited protocol, but it has one very


important benefit.
- It lets you send data to a server with a URL only.
- This is very important if you want to make access to a web API as
simple as possible.
• There is no need for a front end HTML page to the PHP
program we just saw.
- You can manipulate it through URLs entirely.
• This is something the Post protocol does not do as easily.

9
The POST Protocol
• The POST protocol is most useful on a day-to-day basis.
• POST has no limitations on size of data.
• It has no limitations on data types.
- You can use it to send binary data too.
• It works by placing the encoded data in a standard HTTP
header.
- As such, the data does not appear in the URL.

10
The Limitations of POST and GET
• Both of these protocols permit you to send data to a PHP
script.
• That data persists only as long as the script is running.
- If we reload a page that contains a script, it will usually ask if we
want to resend the data.
• If we move outside the confines of a single PHP script, we
will lose the data.
• That is a consequence of HTTP’s statelessness.

11
Cookies and Sessions - 1

– Cookies are little files stored on a user’s computer that


contain certain pieces of information.
• They are then read in by a web page and accessed to ensure data
can be available between pages.

– Sessions fulfill the same role, but most of the information


does not get stored on a user’s computer.
• It is available only as long as their browser is open and the session
is active.

12
Cookies
• When using cookies, we must declare them before any of
the HTML in a script.
- This is because they are part of an HTTP header rather than part
of the content.

• Cookies are available on the next page load.


- You cannot set and access a cookie in the same pass.

• Cookies are set using the setcookie function.


- This takes two parameters – a name for the cookie and its value.
• You can add a third to define an expiration time.

13
Cookie Example

<?php
$thetext = $_POST["mytext"];
setcookie ("texttokeep", $thetext, time() + 10000);
?>
<html>
<head>
<title>Cookie Page</title>
</head>
<body>
<?
echo "<p>The post text " . $_POST["mytext"] .
", we won't be able to pass that on.</p>";
?>

<a href = “cookie2.php">Onto the next page</a>

</body>
</html> 14
The Next Page – cookie2.php

<html>
<head>
<title>Passed it on</title>
</head>
<body>

<?php
echo "<p>The post text is " . $_POST["mytext"] .
", we didn't get that passed on.</p>";
echo "<p>The text is still " . $_COOKIE["texttokeep"] .
", as we know from cookies.</p>";
?>

</body>
</html>

15
Manipulating Cookies
• We can change the value of a cookie by altering it directly
in the $_COOKIE variable:
- $_COOKIE[“texttokeep”] = “Hello World”;

• We can delete a cookie by setting its expiry date to be in


the past:
- setcookie (“texttokeep”, “”, time() – (60 * 60));

• We can check to see if a cookie was accepted by


checking the return value:
- If (setcookie (“texttokeep”, “blah”) == TRUE) {

16
Limitations of Cookies

• There are limitations to cookies.


- Not all clients support them.
- Not all users will accept them.

• They are meant for infrequent sending of small pieces of


information.
- The real work of your application should happen on the server.

• They can only hold a small amount of information each.

17
Sessions - 1

• Sessions fill the same basic role as cookies.


- Getting around the statelessness that is inherent in HTTP.

• Sessions are managed by a pair of cookies.


- One on the server
- One on the client

• The client cookie contains only a reference to a session


stored on the server.
- The server thus manages the data for that session.

18
Working with Sessions

• To setup a session, we use the session_start


function of PHP.
- As with a cookie, this must come before any HTML is sent to
the browser.

<?php
session_start();
?>

19
Sessions - 2

– Once you have a session open, you can register


something as being a session variable, like so:
• $_SESSION[“mytext”] = $mytext;

– This makes sure that the mytext variable is available to


any other pages making use of the session.

– The variables are stored in the $_SESSION variable in


the same way that cookies are.

20
Sessions Example
<?php
session_start();
?>
<html>
<head>
<title>Session Page</title>
</head>
<body>
<?php
$mytext = $_POST["mytext"];

echo "<p>The post text is $mytext and we'll register that


in a session.</p>";
$_SESSION["mytext"] = $mytext;
?>
<a href = "session_next_page.php">Onto the next page</a>

</body>
</html>

21
Session_next_page.php

<?php
session_start();
?>

<html>
<head>
<title>Passed it on</title>
</head>
<body>
<?php
echo "<p>The session variable mytext is " .
$_SESSION["mytext"] . ".</p>";
?>

</body>
</html>

22
Manipulation of Sessions

• Once a session has been created, it is relatively simple to


manipulate.
- Most of it is done through the $_SESSION variable.

• If you wish to delete session data, you can use the unset
function:
- unset ($_SESSION[“something_sensitive”]);

• You can destroy a session completely using


session_destroy.

23
Cookies and Sessions - 2
• In the end, which you choose is based on several factors:
- Does the client accept cookies?
• If not, you will need sessions.
- Do you want to store user data over a significant period of time?
• If you do, you will need cookies.

• For the system we develop through this course, you will


use both.

24
Conclusion

• HTTP is a stateless protocol.


- Which makes it a little difficult to make dynamic web pages.
• PHP offers cookies and sessions as a way to resolve this
problem.
- There are two ways of accomplishing the same basic goal.

25
Terminology

– Cookie
• A small piece of data stored on a user’s computer to ease
dynamic application development.

– Session
• A temporary mapping between the state of a server and a client’s
system.

26

You might also like