> 
> **Possible Duplicate:**  
> 
> [What do I need to store in the php session when user logged in?](https://stackoverflow.com/questions/1221447/what-do-i-need-to-store-in-the-php-session-when-user-logged-in) 
> 
> 
> 

I want to use php sessions to log users in. Once I verify their identity, I would store their user\_id and has\_logged\_in in a session. To verify that they're logged in, I would check if their user id is set and has\_logged\_in is true. Occasionally, I would regenerate the session id through session\_regenerate\_id(true). Is this secure enough on its own or do I have to take further measures to prevent hijacking and other session security vulnerabilities?