Question

On an e-commerce site with no username/login to persist cart data, would it be better to use the PHP $_SESSION variable or a browser cookie to persist items in the shopping cart? I am leaning toward $_SESSION since cookies can be disabled, but would like to hear thoughts from you.

Thank you in advance for your consideration.

Answer 1

Neither

No large sites would dare store a user’s cart in a session or cookie – that data is just to valuable.

What customers are buying, when they select items, how many they purchase, why they don’t finish the checkout, etc.. are all very, very important to your business.

Use a database table to store this information and then link it to the user’s session. That way you don’t lose the information and you can go back and build statistics based on users carts or solve problems with your checkout process.

Log everything you can.

Database Schema

Below is a simplified example of how this might look at the database level.

user {
    id
    email
}

product {
    id
    name
    price
}

cart {
    id
    product_id
    user_id
    quantity
    timestamp    (when was it created?)
    expired      (is this cart still active?)
}

You might also want to split the cart table out into more tables so you can track revisions to the cart.

Sessions

Normal PHP Sessions consist of two parts

1. The data (stored in a file on the server)
2. A unique identifier given to the user agent (browser)

Therefore, it’s not $_SESSION vs $_COOKIE – it’s $_SESSION + $_COOKIE = “session”. However, there are ways you can modify this by using a single encrypted cookie which contains the data (and therefore you don’t need an identifier to find the data). Another common approach is to store the data in memcached or a database instead of the filesystem so that multiple servers can access it.

What @Travesty3 is saying is that you can have two cookies – one for the session, and another that is either a “keep me logged in” cookie (which exists longer than the session cookie), or a copy of the data inside separate cookie.