You can use cookies although they are not as secure as session is mainly because they are stored on the client side. Another option is to not use session and create a more robust object oriented solution. Creating the sql session database is pretty easy really, I'd suggest that as it can be used for multiple applications if need be.