Shopping cart persistence: $_SESSION or browser cookie?

Neither

No large sites would dare store a user's cart in a session or cookie - that data is just to valuable.

What customers are buying, when they select items, how many they purchase, why they don't finish the checkout, etc.. are all very, very important to your business.

Use a database table to store this information and then link it to the user's session. That way you don't lose the information and you can go back and build statistics based on users carts or solve problems with your checkout process.

Log everything you can.

Database Schema

Below is a simplified example of how this might look at the database level.

user {    id    email}product {    id    name    price}cart {    id    product_id    user_id    quantity    timestamp    (when was it created?)    expired      (is this cart still active?)}

You might also want to split the cart table out into more tables so you can track revisions to the cart.

Sessions

Normal PHP Sessions consist of two parts

1. The data (stored in a file on the server)
2. A unique identifier given to the user agent (browser)

Therefore, it's not $_SESSION vs $_COOKIE - it's $_SESSION + $_COOKIE = "session". However, there are ways you can modify this by using a single encrypted cookie which contains the data (and therefore you don't need an identifier to find the data). Another common approach is to store the data in memcached or a database instead of the filesystem so that multiple servers can access it.

What @Travesty3 is saying is that you can have two cookies - one for the session, and another that is either a "keep me logged in" cookie (which exists longer than the session cookie), or a copy of the data inside separate cookie.

As pointed out by Xeoncross, it is very important to store any possible information for analysis. So one should not entirely rely on sessions and cookies.

A possible approach is-

Use sessions if not logged in

If the user is not logged in, you can store and retrieve the cart items and wishlist items from session using $_SESSION in PHP

Use database when logged in

If the user is logged in then you can consider one of the two options -

• Store the cart item or wishlist item in database alone
• Store the cart item or wishlist item in database as well as in session (This will save some of your database queries)

When user logs in

When the user logs in, get all the cart items and wishlist items from the session and store it in the database.

This will make the data persistent even if the user logs out or changes the machine but till the user has not logged in, there is no way to store the information permanently so it will not be persistent.

Getting required data

Whenever you are trying to access cart or wishlist do the following check -

• If the user is not logged in then look into session
• If the user is logged in, query database if you are storing in the database alone, otherwise you can just look into sessions if you are keeping session updated along with the database

I would store it in a SESSION. My wish list is rather long, and I am afraid that it will not fit in the 4K storage that a COOKIE may occupy. It forces you set the session time out to a longer period.

note: there are some countries (like the Netherlands, where I am) that have very strict policies about cookies, and you may be forced by legislation to use Sessions.