Cookies
A cookie is a small string stored in the browser. setcookie('theme', 'dark', time()+86400, '/'); then $_COOKIE['theme']. Use for theme or ‘remember me’ token — not the raw password.
HttpOnly cookies are harder for JS to steal. Expiry in the past deletes a cookie.
Trap — setcookie after HTML started. Trap: huge data in cookies — use sessions.
Exam tip
setcookie then $_COOKIE. Sessions for login state.