If the user successfully enters the password and username and you want to establish a session, what data should the sessions contain? I'm pretty confused by this, I read that it should be a randomly generated string, is it possible to store a hashed user_id + salt? I want to make sure that this is really the correct user:
The form:
<form method="POST" action="">
<input type="hidden" name="auth_token" value="<?php echo $form_token; ?>">
Username: <input type="text" name="username">
Password: <input type="password" name="password">
<input type="submit" name="action" value="Login">
</form>
I want to do something like the following:
if form token in session = form_token var in form
if username and password are correct
set session hash(user_id + salt)
Edit: I forgot to add, most likely, it will be on shared hosting.
source
share