Question

I consider $_GET and $_POST to be input in a web application written in PHP. That’s because they contain values that the user can define and that “comes” along with the HTTP request. But are sessions and cookies the same?

This question came to me when I was reading the wikipedia PHP italian page that says that common inputs are $_GET, $_POST and $_SESSION.

Answer 1

If for input you mean “all the things coming in the request” (so, things that need validation, etc.), you should include:

• POST/GET vars ($_POST, $_GET)
• Cookies ($_COOKIE)
• The request path ($_SERVER["REQUEST_URI"])
• The HTTP method ($_SERVER["REQUEST_METHOD"])
• The HTTP headers (usually in $_SERVER["HTTP_"*])

The session is a special case since all the session variables are stored on the server-side, i.e. the user cannot modify them as it would with cookies. Anyways, a single cookie is saved on the client-side to store the session ID, that can be reset / set to a custom value by the user.

Update – about $_REQUEST

As pointed out, in PHP you also have access to $_REQUEST, that is a mix of variables from $_GET, $_POST, $_COOKIE.
The exact content of $_REQUEST is determined by the request_order directive in php.ini.