Question

I’m new to PHP, I’ve read a lot of tutorials about cookies and sessions but I don’t understand some things clearly:

1. The session values are stored on the server, only the session id is stored in the users computer. Right?

2. Can I make a session that never expires, that is never deleted from the server and to save the session id in a cookie ? If yes than how ? (please provide me some code)

3. It`s not good to store data like passwords in cookies because cookies are not secure ? Right ?

4. It`s possible for a hacker to create a cookie with a session id of an another user ? Can a hacker guess the session id of a session or worst, the list with each session id ?

5. For a good login system (used for forums or websites where the user have some data) that can remember an user is better to use cookies, sessions or a combination of both with session id stored in cookies ?

6. Please provide me some code about how could I store the session id in a cookie and than how I can access a session if I know the session id

Thanks!

Answer 1

Let’s see…

1. right
2. session that never expires ? Not quite a good idea :
   • your served would get filled with old, useless, sessions
   • Instead, you should store some data in a long-lasting cookie ; and use that cookie to re-create the session (auto-connecting the user, for example) when the user comes back later
3. cookies are not secure indeed : they are stored unencrypted, and go through the network unencrypted (unless you use HTTS).
4. If your hacker can get the session id of another user (by reading his cookies, typically), yes, he can access his session
5. I would use both : anyway, if using a session, you need a way to store its identifier.
6. storing the session id in a cookie ? PHP will do that for you, if configured properly 😉