title: Are CodeIgniter database sessions more secure even if cookies are encrypted?
body: <h2>Question 1</h2>
  
  <p>Basically, what I'm asking is: Is <code>$config['sess_use_database'] = TRUE;</code> more secure even if <code>$config['sess_encrypt_cookie'] = TRUE;</code>?</p>
  
  <p>I keep stumbling on blogs, Stackoverflow posts, and even CI Docs that claim <code>$config['sess_use_database'] = TRUE;</code> is more secure, but it seems that the location <code>user_data</code> is stored (in cookie or in database) shouldn't quite matter from a security standpoint if the cookie is encrypted anyway.</p>
  
  <h2>Question 2</h2>
  
  <p>If you set <code>$config['sess_encrypt_cookie'] = FALSE;</code> and inspect the cookies, regardless of the value of <code>$config['sess_use_database']</code>, there is a (what appears to be md5) hash stuck on the end of the cookie - here's an example:</p>
  
  <pre><code>a:4{
    s:10:"session_id";
    s:32:"a2caac03fc72d709ac280540a09d8ed7";
    s:10:"ip_address";
    s:9:"127.0.0.1";
    s:10:"user_agent";
    s:100:"Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.4 (KHTML, like Gecko) Chrome/22.0.1229.14 Safari/537.4";
    s:13:"last_activity";
    i:1347228760;
  }7aa8ebe3fc462bd86c0c0544a969cbda
  </code></pre>
  
  <p>What is the significance of <code>7aa8ebe3fc462bd86c0c0544a969cbda</code>? Where did it come from?</p>