Both are ways to persist data across HTTP requests, but they store data in different places and serve different purposes.

Call session_start() at the very beginning of your script (before any output).

session_start();
if (isset($_POST['login'])) {
    $_SESSION['user_id'] = $userId;
}
if (isset($_SESSION['user_id'])) {
    echo 'Welcome';
}

Session fixation is when an attacker forces a user to use a known session ID. Prevent it by regenerating the session ID on login.

if (validate_credentials($username, $password)) {
    session_regenerate_id(true);
    $_SESSION['user_id'] = $userId;
}

setcookie('user_preference', 'dark_mode', [
    'expires' => time() + (30 * 24 * 60 * 60),
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Strict'
]);
echo $_COOKIE['user_preference'] ?? 'light_mode';

Session hijacking is when an attacker steals a valid session ID. Prevent by using HTTPS, httponly flag, and regenerating IDs on login.

Store a secure token in database and set a long-lived cookie. On subsequent visits, validate the token before logging in.

$token = bin2hex(random_bytes(32));
$db->query('INSERT INTO remember_tokens (user_id, token, expires) VALUES (?, ?, ?)',
    [$user_id, hash('sha256', $token), time() + (30 * 24 * 60 * 60)]);
setcookie('remember_token', $token, ['secure' => true, 'httponly' => true]);

CSRF happens when an attacker makes a user unknowingly send requests. Main defense is a CSRF token in forms.

if (!isset($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
if ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die('CSRF token mismatch');
}

setcookie('admin_token', $token, [
    'path' => '/admin',
    'secure' => true,
    'httponly' => true
]);
setcookie('user_id', $id, [
    'domain' => '.example.com',
    'secure' => true
]);