In my experience you use both. Since the items you are going to be "selling" are a relatively static set, they are in the database. OTOH, there's no reason to put casual users into the database, so you keep track of browser sessions with session variables, including the items, quantities, whatever, that the user wishes to purchase, and then slap it into the db once you have some level of commitment to buy....
