Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I’m just wondering. What’s the difference in PHP between setting a cookie without expiration (meaning it expires as the browser closes) and setting a session variable. I’m not talking about login and stuff like that; rather not needing to fetch less-frequently changes database values on every page visit, etc.
P.S: you can protect your cookies even more by using http_only cookies. For PHP you could read http://ilia.ws/archives/121-httpOnly-cookie-flag-support-in-PHP-5.2.html. I forgot to do for this session example, but did use it for cookie example 🙁. When you use this your cookies can not be read from JavaScript with most browsers(that support http_only). To use http_only cookie for your session:
ini_set("session.cookie_httponly", 1);They can keep track of the same information, but with cookies(not using session) all information is stored on user/webbrowser which can be stolen by hackers or even altered to provide false information. For simple things you could use cookies, but then again I think you could also use sessions, because when you use cookie you need to transmit more information over the wire.
The internet(HTTP) standard is a stateless protocol(no memory) which has the advantage that it simplifies server design. The internet uses cookie to make it “remember”.
Sessions only use cookie to store PHPSESSID inside cookie. Standard the rest of the information is stored on disc which is more secure way to keep state (store sensitive information). You could also encrypt your cookie to do this, but I think sessions is are nice way to do this.
You can override this behaviour and probably should when your website has high traffic to use something like memcached/redis to just store the session information inside memory(Memory is a lot faster than spinning disc to read file because memory also has no moving parts and is very close to CPU). For this to do you need to override session_set_save_handler. It is pretty easy to do with redis. To install redis just type
make. Predis is the recommended(popular) redis client library for PHP. To save session information inside redis you could use redis-session-php.Session
Code
I created a really simple php file to demonstrate sessions.
Curl first time saving cookie
I am using Linux Ubuntu below.
-v: Make the operation more talkative-c: Write cookies to this file after operationNext we show output cookie created by our session
Standard PHP uses the file-system to store data belonging to session(PHPSESSID).For me the files are located at
/var/lib/php5As you can see it stores that information inside
file sess_d5jfijp8515pbhnoe43v4rau97. It is using serialize under the cover to convert object to string.I need to sudo because I can standard not read from that location
The read bit has not been set for that directory
Curl second time using saved cookie
-b: Cookie string or file to read cookies fromAs you can see we can count without storing any of that information inside cookie. We use the same cookie to remember our state. You can also see that the information on disc has changed to reflect this.
Cookies
When just using cookies everything is stored on the users computer.
Code
First time with Curl storing cookie
When we output cookie we get:
As you can see everything is stored inside the cookie and sent over the wire.
Curl Second time using cookie