Notes

The Difference Between Cookies and Sessions
The main difference between cookies and sessions is that cookies are stored in the user's browser, and sessions are not. This difference determines what each is best used for.
A cookie can keep information in the user's browser until deleted. If a person has a login and password, this can be set as a cookie in their browser so they do not have to re-login to your website every time they visit. You can store almost anything in a browser cookie. The trouble is that a user can block cookies or delete them at any time. If, for example, your website's shopping cart utilized cookies, and a person had their browser set to block them, then they could not shop at your website.
Sessions are not reliant on the user allowing a cookie. They work instead like a token allowing access and passing information while the user has their browser open. The problem with sessions is that when you close your browser you also lose the session. So, if you had a site requiring a login, this couldn't be saved as a session like it could as a cookie, and the user would be forced to re-login every time they visit.
Cookies are often used to store a session id, binding the session to the user.A cookie is a bit of information which is sent to your browser and stored there. The browser will send this information back to the server every time you send a request. (to the server that set the cookie)
A cookie is also a store. To create a cookie, the server sends a HTTP header to the client (i.e. the web browser). If the client supports and accepts the cookie, the cookie will be sent back to the server along with every request made to the server.sessions are stored on server machine where as cookies is stored on client machine.cookie is a text file.we can disable cookie anytime we want but that does not hold true for sessions

Physically session is represented with a file that is stored on the server's HDD. When you do session_start() in your script php engine checks for the cookie named after session_name() (which is by default PHPSESSID). If the cookie exists, php tries to find the corresponding file (called session file) and load variables from it. If the cookie does not exists, php creates new session file and sets the cookie. If you need to close the session you may simply unset the cookie which stores the session ID.
Session files are deleted automatically by php according to garbage collection settings.