In PHP, what is the difference between cookies and sessions, and what are the benefits of using them? (Please give me the answer, not Baidu, thank you)?

Reply content:

Let’s not talk about sessions and cookies in Php. Let’s take a look at what session and cookies are in a normal web.

Cookie is actually a technology on the browser side. Since HTTP itself is stateless, generally speaking, the server does not know who is requesting each time. Therefore, a web session allows temporary storage of some content on the client through set-cookie in the HTTP header. The client needs Each HTTP request in this session is accompanied by the contents of the current cookie (it will not be sent if cookies are disabled). Sessions here are generally defined by domain names.

But cookies have two big flaws: 1. Cookies are stored on the client side, so cookies can be read, misappropriated and modified. This means that if any critical information, such as login information, is stored using cookies, others can read, delete, and modify it at will. 2. Other disguised sites may be able to directly obtain your cookie content.

So how to access this information so that it is difficult for the client to delete cookies at will and disguise other users? Generally speaking, there are two major categories of methods: 1. Encrypt the cookie; 2. Only store a signature with self-verification in the cookie, and then store the key data on the server side. This is the session.

session is the application of cookies. Encrypting sessions stored on the client is the easiest to implement and does not bring additional storage burden to the server. Sessions of many new micro-frameworks are implemented in this way (and are not stored on the server). The second is to store it on the server. Optional storage locations include but are not limited to memory, files, external databases, etc.

Php comes with its own library. Cookie is to add cookies that need to be stored on the client side to the response. Session is to add a session_id to the cookie, and then store the things that need to be stored on the server side in the form of files by default.

By the way, modern browsers generally support localStorage. Firstly, it is accessed through the front end but not available from the backend. It is slightly safer for users. Secondly, the amount of storage can be much larger. Thirdly, there is a certain degree of prevention. The capabilities of low-end crawlers. If you do not need to consider compatibility with old browsers, it is more recommended to use localStorage + front-end and back-end separation, and return localStorage content (session_id or encrypted storage content) through js in the form of ajax to replace cookies. Cookie is to store data on the client side. Session is to store data on the server side. The client only stores one ID. The first floor said it very well.
In fact, the biggest difference is that the cookie exists on the client side and the session exists on the server side. And generally speaking, the session does depend on the session id in the cookie. In fact, you can also set the session id yourself, and then specify the session id when using the session. The function of session id is to specify the file stored in the session, so you can use this trick after cookies are disabled.
Another point to add is that sessions should be used with caution in a distributed architecture, because session data may be lost. Of course, you can also rewrite the session so that the session is stored in the cache or database. You can understand it this way, the cookie is someone else's box, and the session is your own box. What are the benefits of the box? Save something