php has a special feature where if cookies are disabled, then they still stay logged in, the cookie code would be auto written in the browser url
ya your options are sessions or cookies. php.net is a good place to check it out or just search google for php sessions. I personally hate using sids.
SIDs in the URL basically stop search spiders in their tracks. The reason is that different query strings still repeat the same page and it is possiblt to have thousands of the same exact page... "not" spidering pages using a session ID in the URL is their answer.
Indeed, you can use sessions. at the top of every page you would nbeed to start a session using session_start(). note though that sessions expire and are killed when the browser is closed. so you better go for cookies.