Lesson 1.8: Requests, parameters, cookies and sessions
How a web application receives input and remembers who you are: URL parts, query parameters and GET, form data and POST, how PHP reads them ($_GET, $_POST), why HTTP itself forgets you after every request, and how cookies and server-side sessions fix that. And one classic mistake: secrets in URLs, which end up in logs, browser history and Referer headers. In the lab you search, log in and use your session cookie with curl, read how the PHP code takes parameters, and find a password-reset token sitting in the web server's log.
18 min
You will learn to
- Name the parts of a URL
- Tell GET parameters from POST data and read them in PHP
- Explain why HTTP needs cookies and sessions
- Log in and reuse a session cookie with curl
- Explain why secrets must never be put in URLs
Key terms
- URL
- A web address: scheme (https), host (shop.northwind.example), path (/search.php), query (?q=lamp), and sometimes a fragment (#reviews).
- Query parameter
- A name=value pair in the URL after ?, separated by &.
- GET and POST
- GET asks for something and carries its input in the URL; POST sends data in the request body, usually from a form.
- Stateless
- HTTP keeps no memory between requests; each one stands alone.
- Session
- Information the server keeps about one visitor (for example 'logged in as user 7'), found again through a session ID the browser sends with each request.
- Untrusted input
- Anything that comes from outside the application: parameters, form fields, cookies, headers, uploaded files, even data from other systems.
← Layered models: OSI and TCP/IP · All lessons · Jobs in cybersecurity and your learning path →