PHP Session 與 Cookie 結合實現用戶登入狀態管理類（含完整代碼與原理解析）

本文提供一個生產級 UserLogin 靜態類，結合 Session（伺服器端）與 Cookie（客戶端）實現「記住我」自動登入、跨請求狀態保持、登出清理等完整流程，並附帶登入控制器調用範例與 Session/Cookie 差異深度解析。

核心類 UserLogin

final class UserLogin {
    public static function getUserInfo() {
        if (isset($_COOKIE['user_id']) && $_COOKIE['user_id'] && trim($_COOKIE['user_id']) !== '') {
            if (isset($_SESSION['USER_INFO'])) return $_SESSION['USER_INFO'];
            $dao = new UserDao();
            $user = $dao->find($_COOKIE['user_id']);
            if ($user) {
                $_SESSION['USER_INFO'] = $user;
                self::refreshCookies($user);
                return $user;
            }
        }
        self::clearCookie();
        return null;
    }

    public static function setUserInfo($userInfo) {
        $_SESSION['USER_INFO'] = $userInfo;
        setcookie('docloud_sid', session_id(), time() + 36000);
        setcookie('user_id', $userInfo->getId(), time() + 36000);
    }

    public static function isLogin() { return self::getUserInfo() !== null; }

    public static function delUserInfo() {
        self::clearCookie();
        session_destroy();
    }

    private static function refreshCookies($user) {
        setcookie('docloud_sid', session_id(), time() + 36000);
        setcookie('user_id', $user->getId(), time() + 36000);
        // 同步延長業務相關 Cookie
        foreach (['selected_prj_id','selected_class_id','selected_image_id','test_image_ids','upload_image_ids'] as $key) {
            if (array_key_exists($key, $_COOKIE))
                setcookie($key, $_COOKIE[$key], time() + 36000);
        }
    }

    private static function clearCookie() {
        foreach (['docloud_sid','user_id','selected_prj_id','selected_class_id','selected_image_id','test_image_ids','upload_image_ids'] as $key)
            setcookie($key, '', time() - 36000);
    }
}

登入控制器調用範例

require_once 'Init.php';
if (UserLogin::isLogin() && $_COOKIE['user_id'] == 1) UserLogin::delUserInfo();
elseif (UserLogin::isLogin()) Utils::redirect('welcome');

$msg = '';
if (isset($_POST['username'], $_POST['password'])) {
    $username = addslashes(trim(stripslashes($_POST['username'])));
    $password = addslashes(trim(stripslashes($_POST['password'])));
    $errors = LoginValidator::validate($username, $password);
    if (empty($errors)) {
        $dao = new UserDao();
        $user = $dao->findByName($username);
        $user->setLastLoginIp(Utils::getIpAddress());
        $user->setLastLoginTime(new DateTime());
        $dao->save($user);
        UserLogin::setUserInfo($user);
        Flash::addFlash('登入成功！');
        Utils::redirect('welcome');
    }
    foreach ($errors as $e) $msg .= $e->getMessage().'<br>';
}

Session vs Cookie 核心差異速查

最佳實踐：登入憑證、權限等核心資訊放 Session；「記住我」長效 Token、UI 偏好放 Cookie；並對 Cookie 內容簽名/加密防竄改。