Native sessions or CI sessions.

[eluser]WanWizard[/eluser]
Be very careful with a remember me cookie.

It is essentially a replacement credential, if I can hijack that, I don't need a session cookie or someone's userid and password. It will log me in as the user I stole it from, no questions asked!

Use a random token, store that in the user record, and encrypted in your remember-me cookie, preferably with IP address and/or user agent string. Every time the cookie is used, generate a new random token, and update the cookie.

p.s. and don't forget to use a random salt when using encryption.