title: PHP sessions and cookies in a login system
body: <p>I have read in a lot of places like, <a href="http://www.sitepoint.com/users-php-sessions-mysql/" rel="nofollow noreferrer"><code>session_start()</code> creates a cookie</a>, <a href="http://www.htmlgoodies.com/beyond/php/article.php/3472581" rel="nofollow noreferrer"><code>session_start()</code> creates a cookie</a>that under default configuration of php.ini <code>session_start()</code> creates generates a random <code>sessionID</code> and stores it in a cookie on the user's browser. However, I could not find any reference to this in <a href="http://sg2.php.net/function.session-start" rel="nofollow noreferrer">php.net</a>. Is there a place where I can find some proper documentation and internal working of this?</p>
  
  <p>Secondly, I want to understand a sequential step by step process of how a simple login system would look like in PHP in conjunction with the above, i.e session, the <code>sessionID</code> generated and the associated cookie set by <code>session_start()</code>. Please help providing a step-by-step process of this flow, like :- (Assuming that user User1 is already registered into the system and now he is trying to access a page which needs him to be logged into the system)</p>
  
  <ol>
  <li>User1 clicks the URL hxxp://restrictedPage.php (for example)</li>
  <li>System checks and see that User1 is not logged in - meaning say system checks to see if there is a valid sessionID apparently in place here. (So what exactly would be checked ?)</li>
  <li>Since the check (which I need help with) in step 2 fails user is redirected to login.php (say for example) that has the login form.</li>
  <li>On the login form user enters username and password and submits the POST form. </li>
  <li>Server side - authenticateUser.php (say for example) verifies the <code>$_POST['userName']</code> and <code>$_POST['password']</code> with the db values. Let's assume that this checks returns true, i.e the username and password supplied by the user was correct. </li>
  <li>What happens now from here on? Where does the session come into picture and when is the cookie with the <code>sessionID</code> created? When is it sent to the browser? </li>
  <li>Now when the session is in place (which I need help with understanding how exactly) and the user comes to a landing page after the login, say, welcome.php which also has a link to restrictedPage.php and now when the user clicks on this link, how exactly is the session validated on the server? I mean the cookie holding the <code>sessionID</code> would be sent with this request, but where is it cross checked with the <code>sessionID</code> already present on the server? Is it done explicitly (like we do for validating username and password from db) or is it taken care of automatically by PHP?</li>
  </ol>