PHP Cookies Explained for Beginners (With Examples)

What are PHP cookies, and how do you use them? A cookie is a tiny piece of text that your website asks the visitor's browser to save. In PHP, you create one with the setcookie() function and read it back with the $_COOKIE variable. In this beginner guide, you will learn both, step by step, with small examples you can copy and run.

What is a cookie?

A web server forgets you the moment it sends a page. It does not remember who you are on the next visit. A cookie solves this. The server sends a small note, such as theme=dark, and the browser stores it. On every later request to the same site, the browser sends the note back.

Common uses for cookies are remembering a language choice, a light or dark theme, or the fact that someone closed a welcome banner. A cookie is small text data. It is not a program, and it cannot run code.

How to set a cookie in PHP

Use the setcookie() function. It needs at least a name and a value. Here is the simplest example.

<?php
setcookie("username", "Maria");

echo "Cookie has been set!";
?>

Line 2 asks the browser to save a cookie named username with the value Maria. Line 4 prints a message. This cookie has no end date, so it lasts only until the visitor closes the browser. That is called a session cookie.

Important rule: call setcookie() first

Cookies travel in the HTTP headers, which are sent before the page content. So you must call setcookie() before any output. Output means any echo, any HTML, or even a blank line before the opening PHP tag. If you break this rule, PHP shows a warning that says headers were already sent.

How to read a cookie in PHP

PHP puts all cookies sent by the browser into a special array called $_COOKIE. An array is a list of values, and here each value has a name. Always check that the cookie exists before you use it.

<?php
if (isset($_COOKIE["username"])) {
    echo "Welcome back, " . htmlspecialchars($_COOKIE["username"]);
} else {
    echo "Hello, new visitor!";
}
?>

Line 2 uses isset() to ask: does a cookie called username exist? If yes, line 3 prints a greeting. The htmlspecialchars() function makes the text safe to show on a page. Line 5 runs for first-time visitors.

There is one surprise. A cookie you set with setcookie() is not in $_COOKIE during the same request. It appears on the next page load, because the browser only sends it back later.

Make a cookie last longer with an expiry time

The third argument of setcookie() is the expiry time. It is a Unix timestamp, which counts seconds since January 1, 1970. The easy way is to take the current time with time() and add some seconds.

<?php
$thirtyDays = time() + (60 * 60 * 24 * 30);

setcookie("theme", "dark", $thirtyDays, "/");
?>

Line 2 works out the moment 30 days from now: 60 seconds times 60 minutes times 24 hours times 30 days, added to the current time. Line 4 saves a cookie named theme with the value dark until that moment. The last argument, "/", is the path. It makes the cookie available on every page of your site, not only the current folder.

Use safer cookie options

Since PHP 7.3 you can pass an array of options. This is easier to read and lets you turn on important security settings.

<?php
setcookie("theme", "dark", [
    "expires"  => time() + 86400 * 30,
    "path"     => "/",
    "secure"   => true,
    "httponly" => true,
    "samesite" => "Lax",
]);
?>

Each line inside the array is one setting. expires is when the cookie dies. path is where it works. secure sends it only over HTTPS. httponly hides it from JavaScript, which protects against some attacks. samesite limits sending it from other websites, which helps against another kind of attack called CSRF. Turn these on by default.

How to delete a cookie

PHP has no deleteCookie() function. Instead, you set the same cookie again with an expiry time in the past. The browser then removes it.

<?php
setcookie("theme", "", time() - 3600, "/");
?>

The value is empty, and the expiry time is one hour ago (time() - 3600). The path must match the path you used when you created the cookie, or the browser will not delete it.

A small real example: remember the theme

Let us combine everything. This page remembers whether a visitor chose a light or dark theme.

<?php
$allowed = ["light", "dark"];

if (isset($_GET["theme"]) && in_array($_GET["theme"], $allowed)) {
    setcookie("theme", $_GET["theme"], time() + 86400 * 30, "/");
    $theme = $_GET["theme"];
} elseif (isset($_COOKIE["theme"]) && in_array($_COOKIE["theme"], $allowed)) {
    $theme = $_COOKIE["theme"];
} else {
    $theme = "light";
}
?>
<body class="<?= $theme ?>">
  <a href="?theme=light">Light</a> |
  <a href="?theme=dark">Dark</a>
</body>

Line 2 lists the two themes we accept. Lines 4 to 6 run when the visitor clicks a link such as ?theme=dark: we check the value is allowed, save it in a cookie for 30 days, and use it right away. Lines 7 to 8 run on later visits and read the saved cookie. Line 10 is the default. Checking the value against a list matters, because users can edit cookies and URLs freely.

Cookies vs sessions: which should you use?

Cookies are stored in the visitor's browser, so the visitor can see and change them. Sessions keep data on the server and only put a random ID in a cookie. Never store passwords or private data in a normal cookie.

Common beginner mistakes

• Printing something before calling setcookie(), which causes the headers already sent warning.
• Expecting a new cookie to appear in $_COOKIE on the same page load.
• Forgetting the path when deleting, so the cookie stays.
• Trusting cookie values without checking them. Always validate and escape.
• Storing sensitive data such as passwords in a cookie.