Core Auth Library

[eluser]Circuitbomb[/eluser]
Storing email in a session is application specific, because you have to consider what the uses of having such a string in the session will be used for in the first place. An extra unique variable (md5()email), would help decrease the chances of some attack vectors such as request forgery if it was used as a hidden user specific unique key in form submissions.

Storing an email session side could limit the amount of calls to a database if the system has a heavy amount of traffic. Grabbing a session var would be faster than calling the database in most cases, and likely done with less code since to set the var in the first place would only really require one call with each session creation.

Performance issues can always be tweaked in php.ini settings as well, if the developer has access to those configurations, and in some cases if they do not, within .htaccess.

As with what thody stated, I couldn't imagine a member system which did not require an email address. The applications for that information simply cover a wide array of usefulness (password recovery, newsletters, verification, and an additional unique identifier in the database). Unless the system had no need to use it, then of course it would be omitted.