PHP: Sessions vs Cookies
HTTP is a stateless protocol, which means that as soon as a page has been sent to the client and the connection is closed any data that has been stored is lost. As a PHP Developer, you often need a way of storing information across multiple pages of your website. The potential uses for this are many. A few examples would be tracking if a user has logged in or perhaps remembering previously set preferences for custom user pages. The common way of accomplishing this via PHP is with sessions and cookies.
A cookie is a small file that is stored on the client computer when visiting a website. Cookies got a bad rap a few years ago and as a result there is a good deal of people out there with their cookies disabled. Cookies are harmless. Some sites will use them to track visitor usage and habits and people sometimes consider that an invasion of privacy, but it typically is not a problem.
Here are some of the features of a cookie:
- Stored on the client computer and are thus decentralized.
- Can be set to a long lifespan and/or set to expire after a period of time from seconds to years.
- They work well with large sites that may use several webservers.
- Won’t do you any good if the client has set their browser to disable cookies.
- Limitations on size and number: a browser can keep only the last 20 cookies sent from a particular domain, and the values that a cookie can hold are limited to 4 KB in size.
- Can be edited beyond your control since they reside on the client system.
- Information set in the cookie is not available until the page is reloaded.
Sessions are a combination of a server-side cookie and a client-side cookie, where the client-side cookie is simply a reference id to the information stored in the server-side cookie.
Here are some features of sessions:
- Server-size cookie can store very large amounts of data while regular cookies are limited in size.
- Since the client-side cookie generated by a session only contains the id reference (a random string of 32 hexadecimal digits, such as ‘
fca17f071bbg9bf7f85ca281653499a4' called a 'session id') you save on bandwidth.
- Much more secure than regular cookies since the data is stored on the server and cannot be edited by the user.
- Only last until the user closes their browser.
- Won’t work if client has cookies disabled in their browser unless some extra measures are taken (example below).
- Can be easily customized to store the information created in the session to a database. (example here)
- Information is available in your code as soon as it is set.
How to use Sessions when Cookies are Disabled
If cookies are disabled you must use a different method to pass the session id. A popular method is to pass it in the querystring and then process it in the subsequent page using
$_GET, like so:
Then use the following in the loading page to retrieve the session id:
When to use one over the other
Cookies generally should be used for non-sensitive ‘throw-away’ information like the following:
- Displaying the users name next time they visit the site.
- Simple user display preferences.
- Anything small and disposable that needs to be stored for a period of time (for info like, email address, contact info etc. a database should be used)
Sessions are used for more sensitive info like controlling user access or loading info from a database that expires when the session ends or the browser window is closed.
The source of the above information is a combination of experience, various articles and sites on the web. The most influential being The Practical PHP Programming Wiki and php.net.
Originally posted September 13th, 2007 at http://klovera.com/blog/php-sessions-vs-cookies (which should 301 redirect here).