Storing session data in a database

[FrEaKmAn]

Hi

I found this article, I hope you're ok with posting links to other sites

http://shiflett.org/articles/storing...-in-a-database

basically it's nice way to store sessions in a database and I'm wondering if I can do something like this. If we use login page and if login is successful, that we only assign and insert for example login variable equal to 1 and maybe also user id, for example 10, so that then I could use the script to check if user is logged in and show data to him/her. Is this smart thing to do? Or should I be afraid of some security breaches? Because until now I always assigned username and password to sessions, and then on every page load I checked database if u/p match, but this could a problem when we have tons and tons of users, so it's better to check small session table..

[pbmods]

Heya, FrEaKmAn.

External links are fantastic... as long as they don't link to sites that have forums that might be in competition with TheScripts ~_^

Ultimately, you have to store *SOMETHING* in the traditional session so that you can differentiate your Users.

Storing session data in a database is a great way to prevent someone from browsing through your tmp directory and reading other Users' session data, but otherwise it represents no better security than saving session data to files on the filesystem (the default behavior).

Unless you are operating on a shared server, there's not much benefit (aside from the cool factor, of course! :D ) from storing session data in a database.