Native sessions or CI sessions.

[eluser]WanWizard[/eluser]
I gave the arguments, but you can't be bothered. Which is fine by me. I don't care what kind of insecure code you produce.

But someone who gives other people the advice to use PHP sessions in a shared hosting environment, to dump cookie encryption, and to be slack with XSS filtering is just plain dangerous. And that makes me angry.

Some bedtime reading: http://phpsec.org/projects/guide/. Especially the section on data filtering, sessions and shared hosts. And the TS can judge for himself.