PHP Vunerabilities in sessions

[AaronL]

I'm developing a software package in php that uses a login system. I use verification by checking the username and password against the values in my mysql database. After I verify them, I'm using $_SESSION variables to pass through the software to determine if the username and password have been verified already and if not it redirects to the log-in page.

I've recently read about security exploits with $_POST and $_GET that I have already addressed, (at least I hope) my concern now is with session hijacking.
I want to make sure my software is 100% secure. So secure that it passes tests from sites like hackersafe etc...

What is the best way to make a login system with PHP that is secure? Eventually I am going to add an SSL certificate to the software as well.

Any tips involving security would be awesome. Thank you all again!

[AaronL]

No advice for this??

[thesmithman]

Hi Aaron, sorry you didn't get a reply sooner. As I'm sure you're aware, session hijacking occurs when a third party intercepts the packets sent to the server by a logged-in user. When the user logs in and is authenticated, the server sets a session identifier cookie in the user's browser. Each time the user accesses a new page, the cookie data is transmitted again. If your users are not accessing your pages over a secure connection, then anyone with the technical knowledge and nothing better to do with their time could theoretically intercept that cookie data and use it to impersonate the registered user. So I'd say setting up an SSL is your first step.
That's not enough to make your system 100% secure though... I'm not sure what would be. I actually logged in to ask a question about that myself! I know that one critical element is to always escape any user-submitted data, and type-check it when possible (e.g. don't allow strings when you require a number). Best of luck to you.