I have a session that I gave to users that has matching password = stored password, like a simple login system :

```
// Checks Password and Username
if ($pSys->checkPassword($AccountData['password'], $StoredData['password'])) {
    $_SESSION['login'] = true;
}

```

The question is: is this secure enough?

```
// put this on every header page that needs to be loggedin.
function loginCheck(){
    if ( empty( $_SESSION['login'] )) {
        header( 'location:index.php' );
        die();
    }
}

```

Is there a difference between `die()` and `exit()`? Second, some say that I should add `session_regenerate_id()`? (Is that an overkill?) Anyway the real question is said above.

addon\*

I have read [PHP Session Security](https://stackoverflow.com/questions/328/php-session-security) but it seems it doesn't match my problem here (that link is just to general).

Here is the `checkPassword()` method

```
function checkPassword($password, $storedpassword) {
    if($password == $storedpassword){
        return true;            
    }
}

```