Sessions

Start a session

Call session_start() before sending output.

<?php
session_start();
$_SESSION["visits"] = ($_SESSION["visits"] ?? 0) + 1;
echo "Visits: ", $_SESSION["visits"];

Store login-like state

Sessions often hold a user id after authentication. Keep secrets off the client.

$_SESSION["user_id"] = 42;

Destroy a session

Log out by clearing session data.

$_SESSION = [];
session_destroy();

Session tips

• Start sessions before any HTML output
• Do not store sensitive secrets unencrypted in session data casually
• Regenerate session IDs after privilege changes
• Cookie settings matter on real sites (Secure, HttpOnly)