PHP Cookies

Cookies are key/value pairs stored in the browser and sent back with every request. PHP reads them from $_COOKIE and writes them with setcookie().

Set

setcookie(
    name: 'theme',
    value: 'dark',
    expires_or_options: time() + 60 * 60 * 24 * 30,   // 30 days
    path: '/',
    domain: '',
    secure: true,
    httponly: true,
);

Read

$theme = $_COOKIE['theme'] ?? 'light';
echo $theme;

The cookie you just setcookie()d isn't in $_COOKIE until the next request — the browser must send it back first.

Delete

setcookie('theme', '', time() - 3600, '/');   // expired in the past

The flags that matter

Modern signature

From PHP 7.3 you can pass an options array — cleaner with named arguments:

setcookie('sid', $value, [
    'expires'  => time() + 86400,
    'path'     => '/',
    'secure'   => true,
    'httponly' => true,
    'samesite' => 'Lax',
]);

Don't put secrets in cookies

Cookies live in the browser and travel with every request. For login state and similar, store a random session ID in the cookie and keep the real data server-side in a session (next lesson).

Example

<?php
setcookie('theme', 'dark', time() + 3600 * 24 * 30, '/');
echo $_COOKIE['theme'] ?? 'no cookie yet';

Exercise

Test yourself