Hybrid Session - where is it?

[eluser]BrianL[/eluser]
[quote author="WanWizard" date="1278538145"]Where did you get this idea from?

The CI session library can use cookies, or use a database for session data storage. The cookie way is handy for simple sites without databases, for all others use database storage. No need whatsoever to revert to PHP sessions.[/quote]

Here.

Note: The Session class does not utilize native PHP sessions. It generates its own session data, offering more flexibility for developers.

By the way there are many reasons why you would want to use PHP sessions. It is not "reverting" but dependent on what you need (the flexibility part). If you aren't using shared webhosting, the primary concern of PHP default file sessions (the session file being shared and accessible to other clients) is gone. It is also wasting bandwidth at the least and insecure at the worst to store session data client side, encrypted or not (anything that can be encrypted can theoretically be decrypted), and whether or not you set CI sessions to database it still stores all session data in the cookie. The choice to use a database should not just be based on whether the server supports a database, but whether you need to validate the data (as stated in the CI manual). Finally there is nothing wrong with PHP file based sessions in certain conditions (example: you have root for the box and you do not care about file locking problems), or with using any type of session handler at all. It very much depends on what the requirements and the environment is like.

"Because it is there" is not a good enough reason to use databases. Neither is perceived "complexity" of a site. It is a choice related to security, which is dependent on many factors.