Starting and Using Sessions
Start a session with session_start and store data in _SESSION.
Starting and Using Sessions is a free PHP Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the PHP Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Are PHP Sessions?
HTTP is stateless. PHP sessions persist data across multiple requests by storing data server-side and referencing it via a session ID cookie.
session_start()
Call session_start() before any output. It either resumes an existing session or creates a new one.
<?php
session_start();
// Must be called before any echo/HTML outputStoring Data in $_SESSION
The $_SESSION superglobal is a plain array. Assign keys to store data for the current session.
<?php
session_start();
$_SESSION["user_id"] = 42;
$_SESSION["username"] = "alice";
$_SESSION["cart"] = [];Reading Session Data
Access session data on subsequent requests after calling session_start().
<?php
session_start();
if (isset($_SESSION["user_id"])) {
echo "Welcome back, ".$_SESSION["username"];
} else {
echo "Please log in";
}Removing Session Keys
Use unset() to remove individual session keys.
<?php
session_start();
unset($_SESSION["cart"]);Destroying a Session
To fully log a user out: unset all session data, destroy the session, and expire the cookie.
<?php
session_start();
$_SESSION = [];
if (ini_get("session.use_cookies")) {
$p = session_get_cookie_params();
setcookie(session_name(), "", time()-3600,
$p["path"], $p["domain"], $p["secure"], $p["httponly"]);
}
session_destroy();Session Storage
By default PHP stores session data as files in the server temp directory. Custom handlers store sessions in Redis, Memcached, or a database.
Session ID
Get or set the session ID with session_id(). The ID is sent to the client as a cookie named PHPSESSID by default.
Session Lifetime
Control garbage collection with session.gc_maxlifetime (seconds of inactivity before data is eligible for cleanup).
Flash Messages
Sessions are ideal for one-time flash messages after a redirect.
<?php
// Set:
$_SESSION["flash"] = "Profile updated!";
header("Location: /profile");
// Read and remove:
$msg = $_SESSION["flash"] ?? null;
unset($_SESSION["flash"]);
echo $msg;Session vs Cookie
Sessions store data server-side (only an ID is sent to client). Cookies store data client-side. Sessions are more secure for sensitive data.
Summary
Call session_start() at the top of every page that uses sessions. Use $_SESSION to read/write. Destroy the session on logout.
Quick Check
Where must session_start() be called?
Frequently asked questions
Is the “Starting and Using Sessions” lesson free?
Yes — the full text of “Starting and Using Sessions” is free to read here on the web, and the PHP Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the PHP Academy course, upgrade to CoddyKit PRO.
What will I learn in “Starting and Using Sessions”?
Start a session with session_start and store data in _SESSION. You practise PHP Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start PHP Academy?
No prior experience is required. PHP Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Starting and Using Sessions” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this PHP Academy lesson?
Yes. Every PHP Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Starting and Using Sessions
- Session Security Best Practices
- Setting and Reading Cookies
- Cookie Security: HttpOnly and Secure Flags