How can the use of sessions and cookies enhance security in PHP scripts for user authentication?

Using sessions and cookies can enhance security in PHP scripts for user authentication by storing sensitive information on the server side (in sessions) rather than on the client side (in cookies). Sessions store data on the server, making it less vulnerable to attacks such as cross-site scripting (XSS) or cross-site request forgery (CSRF). Cookies can be used to store a session ID on the client side, allowing the server to identify the user without exposing sensitive information.

// Start a session
session_start();

// Set session variables
$_SESSION['user_id'] = $user_id;

// Set a cookie with the session ID
setcookie(session_name(), session_id(), time() + 3600, '/');

// Retrieve user ID from session
$user_id = $_SESSION['user_id'];