Sesseion or cookies

[setareh]

(sorry for my bad english)
Which of these are better for create a members area:
Session or Cookie.
Please tell me about advantage and disadvantage of each one,
I think if I use session in a website with a huge number of users, it creates a lot of temp file in server. Is it right?

[mcibor]

Session should be passed via cookie, so it's really cookie. However for passing important data you shouldn't be using any user side ways (so no cookie, no post and no get), only db or session.

I would reccommend using session for user validation and some small data. Database for huge chunks of data. Cookie for not relevant data (like remembering login, some non relevant input values, etc.).

You must remember that cookie, get and post can be maliciously prepared - you have no control and no knowledge who the data comes from.

Hope this cleares things
Michal Cibor