motorollin wrote:
BTW, is this an acceptable login/session management solution in PHP?
1. Username and password submitted to login script
2. Username and password checked against details in users table
3. Username and password match a user account
4. UserID retrieved from account
5. session_start();
6. Username and UserID stored in variables in $_SESSION[];
7. At the top of each page, session_start() is called
Is that secure enough?
--
moto
Make sure you store a password
hash in the database, not the password itself.
(The password hash is derived from the password you submitted, this is done with a certain algorithm)
Also, make sure no SQL injection is possible.
Therefore, you must make sure you know all the things that are done with the database, and make a protocol according to that.