PHP Sessions Overview Quiz

Why do best practices require session_start to run before any HTML output?

What does this counter snippet echo on the first request?

<?php
session_start();
if (!isset($_SESSION['hits'])) {
    $_SESSION['hits'] = 0;
}
$_SESSION['hits']++;
echo $_SESSION['hits'];
?>

Why should session cookies be sent with Secure and HttpOnly flags in production?

What does this session_name snippet output?

<?php
session_name('APPSESSID');
session_start();
echo session_name();
?>

Why do authentication flows regenerate the session ID immediately after login?

What does this regeneration snippet echo?

<?php
session_start();
$_SESSION['role'] = 'user';
session_regenerate_id(true);
echo $_SESSION['role'];
?>

What does enabling session.use_strict_mode accomplish?

What does this session_write_close snippet echo?

<?php
session_start();
$_SESSION['step'] = 'alpha';
session_write_close();
$_SESSION['step'] = 'beta';
echo $_SESSION['step'];
?>

Why should most session data remain on the server instead of storing JSON blobs in client cookies?

What does this cookie-param snippet echo?

<?php
session_set_cookie_params(['lifetime' => 3600, 'httponly' => true]);
session_start();
$params = session_get_cookie_params();
echo $params['httponly'] ? 'httpOnly' : 'default';
?>

Why does session.gc_maxlifetime not guarantee that expired sessions disappear immediately?

What does this session_destroy snippet echo?

<?php
session_start();
$_SESSION['status'] = 'active';
session_destroy();
echo isset($_SESSION['status']) ? 'exists' : 'cleared';
?>

Why should logout flows call both session_unset and session_destroy before expiring the cookie?

What does this reopen snippet echo?

<?php
session_start();
$_SESSION['step'] = 'alpha';
session_write_close();
session_start();
echo $_SESSION['step'] ?? 'none';
?>

Why should session.cookie_samesite be set to Lax or Strict on most interfaces?

What does this session_id check echo once session_start runs?

<?php
session_start();
echo session_id() !== '' ? 'id set' : 'missing';
?>

Why is storing megabytes of data inside $_SESSION discouraged?

What does this session_save_path snippet echo?

<?php
session_save_path(__DIR__ . '/tmp');
session_start();
echo session_save_path();
?>

Why is session.cache_limiter often set to "private" or "nocache" for authenticated pages?

What does this session_abort snippet echo?

<?php
session_start();
$_SESSION['cart'] = 'item';
session_abort();
echo isset($_SESSION['cart']) ? 'kept' : 'reverted';
?>

Why should production logs include session IDs only in hashed or truncated form?

Why might a project implement a custom session handler backed by Redis or a database?

What does this session_status snippet echo after session_start?

<?php
session_start();
echo session_status() === PHP_SESSION_ACTIVE ? 'active' : 'none';
?>

Why do long-running scripts often call session_write_close before performing heavy work?

What does this lifetime snippet echo?

<?php
session_set_cookie_params(['lifetime' => 600]);
session_start();
$params = session_get_cookie_params();
echo $params['lifetime'];
?>

Why should $_SESSION contain only essential identifiers instead of entire domain models?

Why does preventing session fixation require rejecting session IDs supplied via URL parameters or form fields?

What does this comparison echo after regenerating?

<?php
session_start();
$old = session_id();
session_regenerate_id(true);
echo $old === session_id() ? 'same' : 'changed';
?>

Why must logout processes delete the session cookie in addition to destroying server-side data?

What does this logout snippet echo after destroying the session?

<?php
session_start();
session_destroy();
setcookie(session_name(), '', time() - 3600);
echo session_status() === PHP_SESSION_ACTIVE ? 'active' : 'destroyed';
?>

Why should applications avoid storing authentication tokens in both $_SESSION and long-lived cookies simultaneously?

Why is sticky session affinity in load balancers risky unless sessions are centralized?

What does this AJAX-safe snippet echo?

<?php
session_start();
$userId = $_SESSION['user_id'] ?? null;
session_write_close();
echo $userId ? 'loaded' : 'guest';
?>

What does this cache-limiter snippet echo?

<?php
session_cache_limiter('private_no_expire');
session_start();
echo session_cache_limiter();
?>

What does session_status() returning PHP_SESSION_DISABLED indicate?

Why should session.cookie_path usually match the application base path?

What does this handler inspection echo by default?

<?php
session_start();
echo ini_get('session.save_handler');
?>

Why do some frameworks store only a session identifier for the logged-in user and fetch roles from the database on each request?

Why is it important to release the session lock before performing third-party API calls within a request?

Why should CLI scripts avoid starting sessions unless they coordinate with web requests?