PHP会话欺骗/劫持

Question

When someone logs in to my site, they obviously fill out a form with username and password. The form then checks if that exists in the database (the encrypted version of that password of course), and then starts a session with that person's user ID as the session ID.

Is this prone to any kind of spoofing/hijacking/hacking? Is there a safer way to do sessions so that no one can "log into someone elses account" by mistake?

        session_regenerate_id();

        $_SESSION['SESS_MEMBER_ID'] = $uid;
        $_SESSION['SESS_NAME'] = $email;

        session_write_close();

Answer 1

Your best option is to check the IP address of the user or their user-agent.

Of course they will have to re-authenticate if their IP address changes. For example if a user on a smartphone leaves their WiFi range and start using their cellular network. I think the security pay off for the minor inconvenience of likely a small percentage of users is worth it.