User authentication

[Mentor]

I use a custom session handling system for internal requests and data abut cookies to store more long term information, such as details to auto log users in when they visit the website etc.

[Caleb]

True... the only reason I really find I use Cookies is like someone said above, if a user needs/wants to stay logged in. Or in other situations if you're logging information about the user (like visitor tracking type thing).

Now I do have to disagree with the other thing Caleb said about most people not knowing how to make Cookies secure.... well it's not really any different than Sessions.... as long as you one-way-encrypt the password before storing it you're pretty much good to go (oh, and you just have to make sure the cookie doesn't never expire).... ya...

Not really, it would depend on the user doing it.

Some users just check to see if the cookie, or the session is there, and no real verification on the user or anything else.

I use a custom session handling system for internal requests and data abut cookies to store more long term information, such as details to auto log users in when they visit the website etc.

Same, I don't use $_SESSION at all, my own MySQL session management using a unique indentifier which would relate in some what to using PHP's own session management.

Of course you could always just use the callback provided by PHP for using your own handling system, but heh, making your own would insure that you know how it works

[lolwut]

I use Sessions for well, the session.
If they click "Remember Me!" then it sets a cookie with like a 30 letter string (already in the users row in the database) that is totally unique and when they log on the next day, it goes and gets that string and uses it to get the rest of the information from the database.

[Jin]

I use both sessions and cookies.

Depends if i want the user to still be logged in next time they visit the page.

I do the same,


But I make sure I use session hashing for the cookies for security

[Caleb]

I do the same,


But I make sure I use session hashing for the cookies for security

I do the same with the session hashing as well as checking against the IP and other various things

[Florx]

I use a mixture.

Cookies for saving information if they want [ ] Remember Me.

Sessions for general everything.