Cookies vs. sessions in PHP

by

The concept is storing persistent data across page loads for a web visitor. Cookies store it directly on the client. Sessions use a cookie as a key of sorts, to associate with the data that is stored on the server side.

It is preferred to use sessions because the actual values are hidden from the client, and you control when the data expires and becomes invalid. If it was all based on cookies, a user (or hacker) could manipulate their cookie data and then play requests to your site.

Edit: I don’t think there is any advantage to using cookies, other than simplicity. Look at it this way… Does the user have any reason to know their ID#? Typically I would say no, the user has no need for this information. Giving out information should be limited on a need to know basis. What if the user changes his cookie to have a different ID, how will your application respond? It’s a security risk.

Before sessions were all the rage, I basically had my own implementation. I stored a unique cookie value on the client, and stored my persistent data in the database along with that cookie value. Then on page requests I matched up those values and had my persistent data without letting the client control what that was.

More Related Contents:

  1. How do I expire a PHP session after 30 minutes?
  2. Allow php sessions to carry over to subdomains
  3. PHP session without cookies
  4. Cookies vs. sessions
  5. PHP – Session destroy after closing browser
  6. PHP Sessions with disabled cookies, does it work?
  7. What is the difference between Sessions and Cookies in PHP?
  8. How to destroy the session cookie correctly with PHP?
  9. CakePHP remember me with Auth
  10. PHP session IDs — how are they generated? [duplicate]
  11. PHP authentication with multiple domains and subdomains
  12. PHP session seemingly not working
  13. Setting a cookie in an AJAX request?
  14. how to unset cookie in PHP?
  15. How to send cookies with file_get_contents
  16. “Keep Me Logged In” – the best approach
  17. How to fix the session_register() deprecated issue?
  18. Preventing session hijacking
  19. What is the default lifetime of a session?
  20. PHP sessions timing out too quickly
  21. proper way to logout from a session in PHP
  22. Looping Through All a Server’s Sessions in PHP
  23. Multiple PHP Sessions
  24. Accessing session from TWIG template
  25. Is this a proper way to destroy all session data in php?
  26. PHP __PHP_Incomplete_Class Object with my $_SESSION data
  27. How do I continue a session from one page to another with PHP
  28. Session hijacking and PHP
  29. laravel – Can’t get session in controller constructor
  30. How do I save PHP session data to a database instead of in the file system?

Leave a Comment