Question

This moment if user enter’s correct username and password i just simply creating session:

$_SESSION['userid'] = $user_data[0]->id;
$_SESSION['username'] = $user_data[0]->username);
$_SESSION['loggedin'] = true;

After that, with $_SESSION[‘loggedin’] i can check if user can view part of website or not.

Is this method ‘good/safe’ ?

• Any benefit’s using cookies based and session based authentication ?
• Which method most common site’s using ?
• What you guys using for your sites ?

Answer 1

Have a look at this great answer from Joel Coehoorn on this page .
Most of your questions are answered in this post.

Web authentication state – Session vs Cookie vs?

I hope this will help.

Cheers