Session ID could be stored in cookie or propagated in URL. If you want to store PHPSESSID in cookie only, set it by changeing session.use_trans_sid to 0 ( put
ini_set('session.use_trans_sid', 0);
before session_start() ). You will find out more about sessions in manual