Question

If I set cookies like this:

$_SESSION[md5('ponies'.$salt)] = $value;

so that only knowing the correct key will let you open that data, for example

$data = $_SESSION[md5('ponies'.$salt)];

and adding possibly a salt, will make my sessions data safer?

Answer 1

No. You’re still setting the values with a static key, so it’s pretty easy to just copy the key/value combination to a different client. You can also easily break normal MD5 hashing with rainbow tables. cookie keys are not serialized or secret, they are stored and accessible as stings in the key=value style on the client side.