I'm having a small bit of doubts here as to how sessions should be handled.

Right now, I have a MySQL database where the "users" table has a field for session\_id. If NULL, the user is not logged in? If the value is the same as the value of the PHPSESSID cookie, than the user is logged in.

I don't know why, but I somehow feel this isn't good enough a way to make sure which user I'm dealing with. Is there something I'm missing, or do my fears hold no ground?