Is this PHP login feature safe?

Question

I am currently rewriting my script functions (PHP) for my login system. Is the code below a safe and “good” way to check if a user is registered?

    function loggedin()
    {
        $ID = ($_SESSION['ID']);
        $sql = "SELECT `online` FROM `users` WHERE `ID` = '$ID'";
        $result=mysql_query($sql);
        $count=mysql_num_rows($result);
        $row = mysql_fetch_array( $result );
        if ( $count== 1)
        {
            if ($_SESSION['ID'] && $_SESSION['session_id'])

            {
                if ( $row['online']== 1)
                    return 1;
            }
        }
        else
        {
            return 0;

        }
    }

Answer 1

Beware of Bobby Tables!

$ID = mysql_real_escape_string($_SESSION['ID']);

Reset all input parameters with mysql_real_escape_string()

Or better yet, use parameterized queries with (MySQL) PDO

Answer 2

It is definitely worth adding.

session_regenerate_id(true);

to prevent session fixation .

So this is

if ( $row['online']== 1)
    return 1;

becomes the following:

if ( $row['online']== 1)
{
    session_regenerate_id(true);
    return 1;
}

Answer 3

In addition to the other answers, make sure you check if the session exists first.

function loggedin()
{
    if(!isset($_SESSION['ID'])) return 0;
    $ID = ($_SESSION['ID']);
    ..