Using PHP sessions is very easy, but the best way to make permanent cookies is built you own ones?
I'm building a site and in my local server I can change session.cookie_lifetime, but perhaps you can't do that in a shared hosting, and using this method all users will have a permanent cookie, even when they don't want it.
I'm with Cups, it would best if you explained the reasoning.
One thing that I do with my sites is to instead of exclusively storing sessions in the database (which I do), I serialize a users session data so it can remain persistent. Next time they log in then they their current session is updated with the un-serialized values. Obviously in this approach users have to log in.
I know how to set cookies, thanks. Until now I was using a cookie stored in the MySQL to log in the users that required to remember their login, and then the php session cookie to store all information.
But I read that PHPSESSIONS are slow if there are lots of users, and there's the problem I was saying. And there's no reason to do that with 2 cookies, I should be able to do that with one, no?
So basically I just want to confirm that in my case I should forget the PHPSESSIONS, and store all that in the MySQL, and make a query every time the user makes an action.
I hope it's the correct way.
It is up to you to know how to best secure sensitive data, so understanding how cookies and sessions as well as apache and the Database are configured all play into 'The correct way'.
Sessions are not slow if used for the right thing. It is a very convenient mechanism to keep persistent data while the user travels through stateless html/php pages. Just don't try to use a session like you would a database, then you will say that it is slow.
Well, now I only use my cookies, and I don't use the PHP sessions. I hope it's the correct way.
Since php sessions rely on a unique cookie -- net difference zero. Usually sessions don't give me the level of control I want over the data anyways, which is why I use my own custom cookie/hash tied to a db table and say to heck with $_SESSION.
Especially since you have no guarantee across servers what the max time session data is stored/purged.