get or session?

Question

i have a login form, which is in login.php. after authorization i moove client to some.php file! so, from following two methods, which is better?

1. i can send information aboud user id e.t.c by GET
2. i can use SESSION - s for this

what is more preferred?

and two words about why i ask this question. i hear somewhere that SESSIONs aren't good programing method, and it's not suggested to use them in such situations...

thanks

Answer 1

Sessions are indeed the preferred solution. You can't trust data sent in the querystring ($_GET, $_POST, $_COOKIE etc) because all of those can be changed by the user, but you can trust the that noone has tampered with the $_SESSION data since $_SESSION is stored on the server.

Answer 2

There's nothing inherently bad about sessions. In fact, in this situation I would store the userid in the session rather than passing it around in the URL. It'll be much cleaner, and more professional, IMHO. Storing trivial information in the session is fine.

Answer 3

$_SESSION might have its flaws, but using $_GET for this kind of thing is even worse.