Question

Why I can use setcookie without any preparation while need a session_start() before using $_SESSION?And I think works they do are similar.

Answer 1

Because setcookie() defines a cookie to be sent along with the rest of the HTTP headers. That’s a completely different thing than what session_start() does, e.g. creating a session or resuming the current one based on a session identifier passed via a GET or POST request, or passed via a cookie.

The first just adds something to the header and sends it to the browser, while the other gets the Session ID from $_COOKIEs or $_GET or $_POST and then tries finding the session file in the session_save_path and when found unserializing the values of it into $_SESSION and if not, create a new session, probably using setcookie in the process to set the Session Id.

See the chapter on Sessions in the PHP Manual.

---

_{**Edit** Like @Felix correctly points out below, the session is not necessarily saved in a file. It’s not that important though, because the argument stays the same: `session_start` will find and (re-) initialize your session data, while `setcookie` just does what the name implies.}