会话与 cookie 的（dis）优点
我需要一些有关会议的详细信息。会话变量有哪些缺点？ cookie 和 session 之间，哪一个更好？
I need some details about sessions. What are the disadvantages of session variables?
Between cookies and sessions, which one is better?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我不打算在这里讨论安全性，因为 Infotekka 已经对此进行了相当多的讨论。您似乎在问是否应该使用 SESSION 或 COOKIE，就好像它们是彼此的替代品一样。
他们不是。他们服务器（这是一个错字......但我留下它，因为这是一个很好的双关语）不同的目的。
由于 HTTP 是无状态的，PHP（和其他）提供了通过使用会话在应用程序中模拟状态机的能力。如果不这样做，则必须在每个页面之间使用 POST/GET 来保持数据一致，并且如果用户自行转到另一个页面，数据将会丢失！因此，如果没有会话，您将无法让用户登录到您的网站..至少不能非常一致。
总而言之，SESSION 用于在站点的多个页面之间保存数据，而无需长时间使用 HTTP。这就是它的用途。
我想你可以使用 COOKIE 来做到这一点，但它比 cookie 复杂得多，特别是在处理序列化到会话的对象时。设置的 COOKIE 在下一页加载之前也无法访问，并且必须在脚本的任何输出之前设置（与任何其他标头一样）。
会话应该就是这样的——用户坐在电脑前在网站上工作的时间，无论时间长短。当离开时，会话结束。
Cookie 应该用于长期存储简单数据。如果他们经常访问该网站，他们可能希望记住他们的用户名，以便可以将其存储为 cookie。请注意 Infotekka 指出的安全问题。
编辑：最后，我应该补充一点，COOKIE 是在用户和浏览器之间的每个页面请求上传输的。更多 Cookie 意味着更多的页面加载时间。
I'm not going to touch on security here as Infotekka already went into it quite a bit. It seems like you are asking whether you should use a SESSION or COOKIE as if they are alternatives to one another.
They are not. They server (this was a typo..but I'm leaving it cuz it's a nice pun) different purposes.
As HTTP is stateless, PHP (and others) offer the ability to simulate a state machine in your application through the use of a Session. If you did not do this, you would have to use POST/GET between every page to keep the data consistent, and if the user goes to another page on their own that data will be lost! So without a SESSION, you wouldn't be able to have a user logged in to your site .. at least not very consistently.
To summarize, SESSION is used to keep data between multiple pages of your site without using HTTP for an extended period of time. That's what it is used for.
I suppose you could use COOKIE to do this, but it is much more complicated as cookie, especially when dealing with objects serialized to the session. COOKIEs that are set also cannot be accessed until the next page load and must be set before any output by the script (like any other header).
Sessions should be just that -- the session that the user has when they sit down at their computer for however long to do work on the site. When the leave, the session ends.
Cookies should be used to store simple data for a long period of time. If they go to the website a lot, they might want their username to be remembered for them, so it can be stored as a cookie. Just be mindful of the security issues noted by Infotekka.
EDIT: Finally, I should add that COOKIEs are transmitted on every page request between the user and browser. More Cookies means more page load time.
这是一个非常开放式的问题，但我认为在 PHP 中使用会话时应该考虑的最重要的事情是劫持是多么容易。 PHP 会话将其所有值存储在服务器缓存中，并根据写入客户端 cookie 的会话 ID 来检索这些值。只要该会话处于活动状态，与该会话 ID 连接的客户端将被授予对该会话的访问权限。
有一些可怕的程序，例如 firesheep，可以向您展示获取会话 ID 并将其设为您自己的会话 ID 是多么容易。如果您要将任何安全性建立在该会话的基础上，您需要确保您所做的一切都是通过 SSL 进行的，并且您应该构建第二层验证以确保您的会话没有被劫持。
话虽如此，会话是存储持久值的好地方，您需要在用户应用程序体验的生命周期中访问这些值。
That's a pretty open ended question, but I think the most important thing that you should consider when using the session in PHP is how easy it is to hijack. The PHP session stores all of its values in the server cache, where it is retrieved based on a session id that is written to a cookie on the client. As long as that session is active, a client that connects with that session id will be granted access to that session.
There are some scary programs out there, like firesheep, that can show you just how easy it is to nab a session id and make it your own. If you are going to base any security on that session, you need to make certain that EVERYTHING you do is over SSL, and you should build in some second tier of validation to make sure your session hasn't been hijacked.
All that being said, the session is a great place to store persistent values that you will need to access over the lifecycle of the user's application experience.