Okay guys.
So we are going to build a simple visit counter for the current user.
That will just count how many times he has visited the page.
So we are gonna learn about cookies and sessions and how to send headers.
And we're gonna make it a little bit more complex.
First time someone visits the page, he will be asked to enter the name.
If he wants to do that, he will be tracked anonymously.
Otherwise, every single time he's gonna go back, his name would be displayed.
So let's go ahead and build this simple tracking script.
So I think we should start with cookies here.
So the first thing is to how to check if a cookie exists.
Well I've mentioned previously that we have this super global variables.
And this is how PHP allows you to access cookies.
This is how you can read them, because setting cookies is another story.
You do that using a function.
So I can have a variable called has cookie.
We only care about one specific cookie.
That's why I can call it this way.
And I'm just going to use the set function to check if a variable exists or element in an array exists.
And there is this cookie super global.
Now I'd like to call this cookie user.
And that's the first thing that we did.
We checked if specific cookie exists.
Later on in this video you're gonna see how actually cookies work, where they are stored and all that.
But for now, let's just check if a cookie exists.
For now, let me just say this about cookies.
Cookies are stored in user browsers, and they can be stored for a long time.
I'm gonna go back to cookies a little later in this video.
So we just use this user cookie to recognize a user if he provides his name.
So next up we can customize the message that welcomes the user depending on whether the cookie is set
or not.
Now by default, there is no cookie.
So we can set the welcome message to be welcome back user.
So he is anonymous to us.
Otherwise we can customize this message.
Then we can say welcome back.
And we're going to use HTML special characters.
To escape any HTML user might have provided inside his name, because he will be submitting that through
the form.
And here I can just read the cookie user, because that would be the user name.
So I know that you are probably waiting to see what would this be about?
Why don't we start the server?
Well, we need to finish the functionality at least the basic one first.
So next up we're going to be storing the count of visits in the session data.
So session data is similar to cookies but it's also different.
Session data is stored on the server not in the browser.
And there are more differences which I'm going to be describing at the end of this video.
So we're going to be storing the amount of user visits inside the session.
So my first step is to check if the counter exists.
So I'm using is set and the session super global.
This is how you access and actually also set session data in PHP.
So my variable name will be called visits.
If it doesn't exist I initialize it.
So I set visits to one.
This is the first visit.
Otherwise I'm just gonna increment the visits value by using the plus plus operator.
Finally, I am displaying the visits message.
We're going to have two messages displayed to the user.
This would say this is your.
This is your.
Session visits.
Visit.
Okay, so let's close off the PHP part where we have the logic of our script.
So again I described this a little bit like model view pattern though it is not exactly this pattern
yet.
We are going in the right direction.
We are separating our logic kind of and data with the let's call it presentation layer, which is our
HTML.
So now we need to add the HTML because we would like to present this data to the user and additionally
add a form.
So first let's add the form.
The form should be displayed conditionally only if we don't have the cookie yet.
So this is an alternative syntax that you can use in templates of an if statement.
And then we display the form.
The form has a method of post, and we send to the same URL to the same script.
And this would be simple.
I just ask for the user name using label and I add the input of type text.
Which name is name as the user name.
Let me close this.
And finally we've got a button saying track.
This is only being displayed if there is no cookie yet.
Otherwise we just display the data.
And the data that we have is the welcome message.
And the second one is the visits message.
Okay, now we are ready to start this.
So let me run php s localhost Host 8000 and the script name is session Dash cookies.
PHP.
Okay, there we have it.
There is a form.
We haven't set a cookie.
That's why it is being displayed.
We've got the anonymous message and this is our first visit.
Let's see what happens if I refresh.
So as you see, every single time we are seeing that it is our first visit, let's see why.
So I think now is a good time that I explain how sessions and cookies work and how sessions are connected
to cookies.
Now, let me give you the reason why we constantly see that this is our first visit.
This is because we really haven't started the session and we have to do this first.
So the first thing that I have to call in this file is to call a session, start Function.
Now how this works is the session start function is first checking for the session identifier, which
it happens so is stored in a cookie.
So when you call this function a cookie is created.
It is stored in the user browser.
And next time you visit a page, this function is making sure to retrieve this cookie value to find
your session identifier so that it can identify who you are.
Okay, so now let's open the Chrome DevTools and jump to the application tab.
So cookies are stored in the browser.
And under this cookies menu you can find cookies for a specific domain.
Ours is http localhost 8000.
And here you can find a cookie called php session id.
So as set this is automatically set by PHP and it has this value autogenerated so that PHP can then
identify you.
Now how does this cookie gets its way to a PHP server?
Well, that's a mechanism of all the browsers, so that with every single request like this one right
here, it is sending all the cookies of this particular domain to the server using request headers.
We can find it right here.
There is a cookie header.
And it sends the name of the cookie and the value of the cookie.
So some things that you should know about cookies is that they are stored in the browser.
That's first and most important.
Cookies can be set by JavaScript or by a header that is returned from the server.
This is how PHP is actually setting cookies.
It sends back a response header from the server to the browser.
Cookies have a size limit.
Typically it's four kilobytes and you should not really store any sensitive data inside cookies like
passwords, etc. because this is not safe.
Anyone who gets access to the browser can then figure out the user password or any secret data.
So cookies are not for sensitive data now.
Additionally, cookies can have an expiry date.
This means they can be stored for a long time, maybe one month or even one year.
Okay, now the sessions.
So as I said, the session start function is required every single time so that it can figure out if
this PHP session ID cookie exists, and if it does, then it can identify your session now.
Session means that we are storing some data on the server, so this is more secure than a cookie.
You can store some sensitive data in a session.
Now sessions get auto timeout.
So after around one hour if there is no activity from the user, he doesn't visit the page again.
Session would be automatically destroyed.
Sessions are often used for authentication, so you can sign in to a website and the session keeps the
information about you, your user ID, etc. so to sign out you will typically destroy a session.
There is a special function for that and we're going to use that a little bit later.
Now let's try to solve the issue that our visit counter is increasing by two.
So that is really a strange issue.
Now what is happening here is actually pretty simple.
So the web browser is trying to fetch a favorite icon of our website, which we don't have because we
have just a single PHP file.
And it's actually trying to make a request for this favorite icon.
And that's the reason we get double requests every single time we visit the page.
We can do something about that.
We're going to use the server super global and we're going to check the request URI.
So what's the actual path that the browser is asking for.
And if this is a favorite icon dot icon which is typically the name of the favorite icon, we can just
exit.
So we're going to stop the script.
Nothing will be happening.
Oh, and this needs to start with a slash.
And now, after I save the changes and refresh, we see that the counter is increasing by one.
So we have fixed the issue.
Okay, so finally we need to keep track of the user name if he supplies his name.
So after we start the session we would check if the request here is a Post request.
This would basically tell us that someone has submitted the form.
For that we're going to use the server super global which has the request method value inside.
And we are checking if this equals post.
If that's the case, we can set a cookie by using set cookie function.
Notice that there is a slight difference because the session data is set by assigning to session super
global with cookies.
That's not the case.
You need to use a function.
So we need to give our cookie the name.
This would be just user.
Cookies are stored per domain, so you don't need to worry about other cookies stored in the browser
and the value of it.
We're going to take from the Post-super global name.
So data sent from the form.
So every single time you accept any data sent through the user by forms or any other way, you should
sanitize it or validate it or do both.
Now we actually do sanitization when we display the data.
So maybe this is fine for now.
And I can just store whatever the user sends.
Next up we need to give the cookie the expiry date.
So I can use PHP time function to get the current date.
It returns time in seconds and I add three 3600 seconds, which is one hour and it is a top level cookie,
not for any specific subdomains.
Okay.
So this sets this user cookie.
So I think that we are done.
We've got the whole logic.
Now let me save this.
And now let's try that out.
By the way I just noticed that I have misspelled the visits.
And here this is spelled correctly.
But later on it's not.
Let's fix this first.
Okay.
Now let's try that.
So we have a count counter going.
It's doing fine.
Now let me add my name and keep tracking.
So now when I visit the page I have my name and it is tracking me like this.
Now I can reset the session by going into the application tab, and I can just remove this PHP session
id cookie.
And this would make the PHP server lose track of me.
It would have to restart the session.
So I do delete selected and when I refresh this page it knows that I am Piotr because the user was untouched.
The user cookie.
But PHP session id was recreated so that it had to start counting from scratch.
If I remove both then I'm forgotten and also the session is restarted.
So we have the first visit.
So this is how destroying the session works.
Essentially you're going to call a function for that.
In PHP you're not going to remove cookies.
But this function is doing exactly that.
And this is often used for signing out.
If you are authenticated in an application.