get or session?

Question

i have a login form, which is in login.php. after authorization i moove client to some.php file! so, from following two methods, which is better?

1. i can send information aboud user id e.t.c by GET
2. i can use SESSION - s for this

what is more preferred?

and two words about why i ask this question. i hear somewhere that SESSIONs aren't good programing method, and it's not suggested to use them in such situations...

thanks

Answer 1

There's nothing inherently bad about sessions. In fact, in this situation I would store the userid in the session rather than passing it around in the URL. It'll be much cleaner, and more professional, IMHO. Storing trivial information in the session is fine.

Answer 2

$_SESSION might have its flaws, but using $_GET for this kind of thing is even worse.

Answer 3

Sessions are indeed the preferred solution. You can't trust data sent in the querystring ($_GET, $_POST, $_COOKIE etc) because all of those can be changed by the user, but you can trust the that noone has tampered with the $_SESSION data since $_SESSION is stored on the server.

Answer 4

If I understand the question right, then none. Use POST for this instead and then create SESSION upon logging in.

Let's say user comes to index.php where is login form. He fills in info and push "login". You send the data to login.php using POST. If the user name, password and whatever other information is correct, you create SESSION and redirect user somewhere else.

Answer 5

I would use SESSION if you want to store some information, that is based on the authentication success. Data in GET, POST variables is too easy to manipulate.

Answer 6

If you have to decide between $_SESSION and $_GET, then, for secure stuff, use $_SESSION. All the user can do with sessions is destroy them (by deleting the PHPSESSID cookie), but the user cannot manipulate them.

If you have to pass information once, $_SESSION is very good. You can store some data into the $_SESSION variable, change location via PHP (so the user cannot block the script by means of disabling JavaScript. Just use header('Location: '.$path);), use the $_SESSION content on the other page and the user does not have a time interval when he could destroy the session. This is safe.

Answer 7

The safest way would be to use SESSIONS because that would mean that only a token|identifier is stored on the client side, and all of the data represented by the token|identifier is stored on the server. Besides you can set expiry time for sessions too, that would make it more secure.