Member Avatar for veledrom

Hi,

I use PHP and have a question.

As cookies and sessions have their pros and cons, I don’t know which one is better for shopping card.

If I use cookie then user my block it. Therefore, my e-commerce web site won’t serve the purposes.
If I use session then the content stored in current session will not be remembered in next visit.


What do you prefer?

Thanks

  • 4 Contributors
  • 4 Replies
  • 105 Views
  • 9 Hours Discussion Span
  • Latest Post Latest Post by almostbob

Dani AI

Generated

Building on points from , , and : a pragmatic, production-ready pattern is to keep the cart server-side and use a minimal client-side identifier only. That gives persistence for guests, easy merging for logged-in users, and keeps sensitive data out of the client.

For guests: generate a random opaque cart ID (GUID/UUID) when the first item is added. Store the cart rows on the server keyed by that ID. Persist the ID client-side with a single cookie (or, for JS-first apps, localStorage) but never store item lists or prices in the browser. When a user logs in, atomically attach or merge the guest cart with the account cart and delete the guest entry. This supports cross-visit persistence without relying on IPs.

Security and operations: sign or HMAC the cart ID if you worry about guessing. Set cookie flags (Secure, HttpOnly where appropriate, SameSite) and rotate keys. Snapshot price and VAT per item when added so invoices remain correct even if catalog prices change later. Run a periodic cleanup for carts older than N days to avoid data bloat. For security best practices see the OWASP session management guidance and cookie docs on MDN: Session Management Cheat Sheet and Set-Cookie header.

Handling users who disable cookies: offer an explicit “save cart” flow that emails a one-time cart link, or require an account for persistence. You can use localStorage as a fallback, but note it is accessible to JS and increases XSS exposure; prefer server-side persistence where confidentiality matters.

Implementation tips: store only product_id, qty, timestamp and price_snapshot; use Redis for high-throughput stores and a relational table for long-term carts; always perform merges inside a transaction to avoid races.

Example guest→user merge (pseudocode):

begin transaction
guest = fetch_cart(guest_id)
userCart = fetch_cart(user_id)
merged = merge_items(userCart, guest)
save_cart(user_id, merged)
delete_cart(guest_id)
commit

Recommended Answers

All 4 Replies

Member Avatar for csharplearner

Hi,

I use PHP and have a question.

As cookies and sessions have their pros and cons, I don’t know which one is better for shopping card.

If I use cookie then user my block it. Therefore, my e-commerce web site won’t serve the purposes.
If I use session then the content stored in current session will not be remembered in next visit.


What do you prefer?

Thanks

I think you may have to use user details such as login values(username) or ip address(to save visitor selection of items) along with sessions values such as items in the cart and save it database to retrieve for visitors next visit.

Member Avatar for ShawnCplus

Well if they block cookies they're blocking sessions as well since a user's SESSIONID is stored in a cookie.

Member Avatar for csharplearner

Well if they block cookies they're blocking sessions as well since a user's SESSIONID is stored in a cookie.

Using Sessions one need not store it on user's computer,
if we store the users ip and items in the cart in the database by sessions and later retreive them from database when visitor visits back and use them wouldnt that work?

Member Avatar for almostbob

Using Sessions one need not store it on user's computer,
if we store the users ip and items in the cart in the database by sessions and later retreive them from database when visitor visits back and use them wouldnt that work?

Nope, different ip same user
same ip different user
ip addresses are not fixed they are at the discretion of the ISP

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.