Every PHP request starts fresh and forgets everything when it ends. To keep a visitor signed in, the browser carries a small cookie, the server keeps the real data in a session, and passwords are stored only as hashes, never as text.