Asking "what is the difference between sessions and cookies?" is like asking "what is the difference between beer and a pint glass?"
Just as beer is normally served in a glass, but can be served in other ways, session IDs are normally recorded in cookies, but can be recorded elsewhere if need be.
Basically, sessions are a shrink-wrapped approach to storing data that doesn't need to last longer than the current session. It uses cookies when it can. It inherently has the security advantage that no real data is stored on the client, only a session ID is stored in the cookie. (You can do this yourself with persistent cookies, but all you'd end up doing is replicating PHP's inbuilt mechanism, with added complications regarding cookie expiration.)
Details about how PHP uses cookies for session management can be found in the obvious place.