I have for a while been meaning to write a web app with MySQL/php to manage debts between my friends and myself. I have now started this project.

Users should be able to login and register debts against one another so that at the end of the year all debts can be cross referenced and a list produced indicating what it all boils down to in the fewest transactions.

I am comfortable with the PHP and I am confident that the SQL won't be a problem - the area I am not 100% happy with is the session management.

Now, I am not really concerned with having total security so I am not going to go with https as I don't know how to set that up on Apache anyway. But conversely I don't want to do a complete bodge job on the login process either.

What I have done in the past when making a guest book is having hidden forms that keep your user name and password so that you do not have to resubmit these details with every html request. However that is clearly a bit crap.

Should I be using cookies to manage 'sessions'? Or is there another method without going too hardcore.

Your options are:
- passing PHPSESSID via GET
- cookies
- http authentication e.g http://httpd.apache.org/docs/1.3/howto/auth.html
- use client side javascript to salt a hash http://pajhome.org.uk/crypt/md5/auth.html

Thanks. I think I'll use cookies + whatever I can dream up!