Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
PHP · Question Set
Sessions, Cookies & Authentication interview questions for placements and exams.
Questions
14
Included in this set
Subject
PHP
Explore more sets
Difficulty
Mixed
Level of this set
Go through each question and its explanation. Use this set as a focused practice pack for PHP.
Cookies have attributes like name, value, expiry time, path, domain, and flags such as Secure and HttpOnly. The Secure flag ensures cookies are sent only over HTTPS, and HttpOnly prevents access from JavaScript for safety.
For complete preparation, combine this set with full subject-wise practice for PHP. You can also explore other subjects and sets from the links below.
When a cookie is set with an expiry time in the past, the browser automatically removes it from storage, effectively deleting it.
setcookie('user','',time()-3600);During logout, destroy all session data using session_unset and session_destroy, remove authentication cookies if any, and redirect the user to a public page. This ensures that no residual session data can be reused.
When a user submits credentials, the system validates them against stored data. If valid, a new session is created with user details. On subsequent pages, PHP checks the session to maintain authentication until logout or session expiry.
The $_SESSION superglobal holds data for the current session, allowing values to be shared across different pages for the same user.
$_SESSION['user'] = 'John';
The $_COOKIE superglobal is used to access cookie values that have been sent from the browser back to the server.
echo $_COOKIE['user'];
The session_start function initializes or resumes a session. It must be called before any output is sent to the browser to enable PHP to use session variables.
session_start();
You can prevent CSRF by generating a unique token stored in the session and embedding it in each login form. When the form is submitted, the server verifies that the token matches the one stored, ensuring the request is genuine.
The session_destroy function removes all session data stored on the server. It is often used during logout to clear the user’s session.
session_destroy();
By default, PHP stores session data as temporary files on the server in a directory defined by the session.save_path configuration in php.ini.
Authentication verifies the identity of a user, ensuring that the person logging in is who they claim to be before granting access to protected areas.
Cookies store data on the client-side, while sessions store data on the server-side. Cookies persist even after the browser is closed unless expired, whereas sessions usually end when the browser closes. Sessions are safer because data is not directly accessible to users.
The 'Remember Me' feature stores a long-lived token in a secure cookie when a user logs in. On subsequent visits, the token is validated with the database to auto-login the user. It should always use encrypted tokens to prevent hijacking.
To secure sessions, use HTTPS to encrypt cookies, regenerate session IDs after login to prevent fixation, set session cookies with HttpOnly and Secure flags, and store minimal sensitive data in sessions.