I am reading the Head First PHP/Mysql book and they say to store both the user's username, email into cookies and sessions.cookies? Should I store both in sessions and cookies or just one of them?
I am not storing any sensitive data in cookies such as password, etc.
It's safe to assume people have cookies if they need to login somewhere. Sessions actually rely on cookies as well. Just be careful what data you actually put in a cookie.
Depending on the kind of site and target audience of course, I would say it's enough to have a small cookie test or info about that cookies should be enabled when people login.
You should also know that PHP uses cookies by default to save the session id
Depends on the task and context.
In general, it is useless to store in both cookies and session. Session is more reliable and secure way.
Though, again, depends on the task. Why do you want to save an email? You save no user data on the server side at all?
Yes, you can store sensitive data in cookies, provided you encrypt the data properly. And sessions are always preferable for storing small chunk of information, sessions are obviously more secure since they are tracked at the server side and client has no idea about them..
Is it safe to assume that everyone know a day has cookies? Or should I store both in sessions and cookies?
2 questions - but both have the same answers.
If the customer does not have cookies enabled then do not attempt to use sessions. Despite some very complex code, its just not possible to handle the situation consistently, securely and reliably.
You might use a persistent cookie as a 'remember me' function - but do look at how eBay, Google et al have implemented this - i.e. only do it if the user specifically asks - and even then, treat it as if it were a long running session (i.e. store the data server side and a put a reference to the data in the cookie). Alternatively, as this.__curious_geek suggests you might consider encrypting it - but bear in mind that this provides no protection against MITM / replay attacks.
I am not storing any sensitive data in cookies such as password, etc.
No - both usernames and email addresses are potentially sensitive.
C.
I would not store username/pass in a cookie. Instead, I would store a login hash. Maybe some combo of the username, IP, user agent, etc. Store the same on the server (SQL), and use that to track logins. You can use that data to eventually resolve the the hash to user information.
Obviously neither of you has read his context. He doesn't have a clue what is a cookie and what is a session.
A cookie, also known as a web cookie, browser cookie, and HTTP cookie, is a text string stored by a user's web browser. (wikipedia.org)
A session is stored on the web server using the session identifier (session ID) generated as a result of the first (sometimes the first authenticated) request from the end user running a web browser. (wikipedia.org)
There are 2 different things.
Mainly to authenticate a user you have to store his login information, either in a $_SESSION or in a $_COOKIE.
the $_SESSION being server side it doesn't have to be dramatically encrypted because only your scripts will read it.
the $_COOKIE has to be always encrypted, because browsers (like Firefox with it has a ton of plugins that print out cookie in formations) can display them, encrypted in that way that the only thing that you can do is to compare his login also encrypted with that cookie to see if he is authenticated or not. Compare not decode. The best encode and easy encryption is MD5.
this doesn't mean that $_SESSION and $_COOKIE are there for authentications or stuff like that, you can do a lot more magic with them.