Sessões e sistema de login

Cookie:                          Session:
Only holds the Session ID        Stores the actual data (username, role, cart...)
┌──────────────┐                ┌──────────────────────┐
│ PHPSESSID    │  ──match──→   │ user: John            │
│ abc123       │                │ login: true           │
└──────────────┘                │ cart: [3 items]       │
   In the browser               │ role: admin           │
                                └──────────────────────┘
                                     On the server

<?php
// session_start() must come before any HTML output
session_start();

// Store data
$_SESSION['username'] = "John";
$_SESSION['login_time'] = date("Y-m-d H:i:s");

// Read data
echo "Welcome, {$_SESSION['username']}!";
echo "Logged in at: {$_SESSION['login_time']}";
?>

<?php
session_start();

// Store any PHP data type
$_SESSION['user'] = [
    'id'   => 101,
    'name' => 'John',
    'role' => 'member'
];
$_SESSION['cart'] = [
    ['name' => 'PHP Tutorial', 'price' => 39.90, 'qty' => 2],
    ['name' => 'MySQL Basics', 'price' => 29.90, 'qty' => 1],
];

// Read
echo $_SESSION['user']['name'];  // John

// Remove a single session variable
unset($_SESSION['cart']);

// Update
$_SESSION['user']['role'] = 'admin';
?>

<?php
session_start();

// Initialize the cart
if (!isset($_SESSION['cart'])) {
    $_SESSION['cart'] = [];
}

// Add an item
if (isset($_POST['add'])) {
    $item = $_POST['add'];
    $_SESSION['cart'][$item] = ($_SESSION['cart'][$item] ?? 0) + 1;
}

echo "<h3>Your Cart</h3>";
foreach ($_SESSION['cart'] as $item => $qty) {
    echo "{$item} × {$qty}<br>";
}
?>
<form method='POST'>
    <button name='add' value='PHP Tutorial'>Add PHP Tutorial</button>
    <button name='add' value='MySQL Basics'>Add MySQL Basics</button>
</form>

<?php
// login.php — Login System
session_start();

// Predefined test users (in a real project, these live in a database)
$users = [
    'admin' => '123456',
    'john' => 'password123',
];

$error = '';

// Already logged in? Redirect to profile
if (isset($_SESSION['user'])) {
    header("Location: profile.php");
    exit;
}

// Handle login request
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = trim($_POST['username'] ?? '');
    $password = $_POST['password'] ?? '';

    if (isset($users[$username]) && $users[$username] === $password) {
        // Credentials verified — store user in session
        $_SESSION['user'] = [
            'username'    => $username,
            'login_time'  => date("Y-m-d H:i:s"),
            'last_active' => time(),
        ];
        
        // Redirect to profile page
        header("Location: profile.php");
        exit;
    } else {
        $error = "Invalid username or password";
    }
}
?>

<h3>Login</h3>
<?php if ($error): ?>
    <p style="color:red"><?= htmlspecialchars($error) ?></p>
<?php endif; ?>

<form method="POST" action="">
    <p>
        <label>Username:</label>
        <input type="text" name="username" required>
    </p>
    <p>
        <label>Password:</label>
        <input type="password" name="password" required>
    </p>
    <button type="submit">Log In</button>
</form>
<p style="color:#888">Test account: admin / 123456</p>

<?php
// profile.php — Profile Page (requires login)
session_start();

// Not logged in? Redirect to login
if (!isset($_SESSION['user'])) {
    header("Location: login.php");
    exit;
}

$user = $_SESSION['user'];
?>

<h2>Profile</h2>
<p>Username: <?= htmlspecialchars($user['username']) ?></p>
<p>Logged in at: <?= $user['login_time'] ?></p>

<a href="logout.php">Log Out</a>

<?php
// logout.php
session_start();

// Option 1: Clear only the user data
unset($_SESSION['user']);

// Option 2: Wipe the entire session
session_unset();    // Clear the $_SESSION array
session_destroy();  // Delete the server-side session file

// Redirect to login
header("Location: login.php");
exit;
?>

User visits for the first time → PHP creates a session file (e.g., sess_abc123)
                ↓
          Data is written to $_SESSION
                ↓
          Cookie sent: PHPSESSID=abc123 to the browser
                ↓
Next visit → Browser sends PHPSESSID=abc123
                ↓
          PHP finds sess_abc123, loads data into $_SESSION
                ↓
... User leaves (closes browser or is idle for a long time) ...
                ↓
Garbage collection → Expired session files are deleted

<?php
// Configure before session_start()
ini_set('session.cookie_httponly', 1);    // JS can't read the session cookie (XSS protection)
ini_set('session.cookie_secure', 1);      // HTTPS only (required for production)
ini_set('session.cookie_samesite', 'Lax'); // CSRF mitigation
ini_set('session.use_strict_mode', 1);    // Reject uninitialized session IDs

session_start();
?>