Hello,

I'm developing a site that will have users login and will also include a simple shopping cart. I'm wondering if its better to use cookies, sessions, or a combination of both to keep track of users logged in and anyone (including non-logged in user's) shopping cart contents.

My inital thinking is that sessions would be easier to manage, but that cookies would allow me to keep track of shopping cart contents if they leave the site and come back... and would also allow me to give users the option of staying logged in for the next time they visit the site. However, I know not everyone has cookies enabled (although granted, most people do - especially those that shop online). Anyway, I'm looking for a little guidance before I go one way or the other.

A brief explanation or link pointing me in the right direction would also be appreciated ;)

Thanks in advance.

Use both - sessions for tracking visitors and state from page to page, and cookies to store info when the users want to stay logged-in.

sessions are implemented using cookies. so in essence they are the same except session cookies are usually implemented such that they expire upon browser closing.

if you create your own session handling script that uses a database or just keeps cookies on the visitor's computer you can store everything you need with sessions for however long you want.

I'm about to code something and have chosen to use cookies for a Google supporting website; know any ways around this using sessions?

I basically don't want google to link to my site with its own session ids.

If you're using PHP:

For the most part sessions usually aren't handled through $_GET so I don't understand why google is linking to your site with session ids in the url. If you're using the native php session_start() function it propagates the session id through a cookie called $_COOKIE["PHPSESSID"].

The solution is simple, if you hardcoded the url appending just remove it. If it is being automatically added by php, then there's probably some setting that your host has on that is forcing php to do that. Hosting problems aside I would just write my own session handling script. A very simple one can be found here:

http://us3.php.net/manual/en/function.session-set-save-handler.php

In example 1. You can easily modify it to make it more secure and connect to a database.