I am programming a PHP site that allows users to register, and both registered and unregistered users can enter their respective usernames and passwords (for example `smith8h4ft` - `j9hsbnuio`) for school site. 

Then, my PHP script sends some `$_POST` variables, downloads and parses the marks page, making an array called: 
`marksDB = Array("subject" => Array("A", "B", "A", "C"), ...)`, and writes it reformatted.

My question is:
**How should I keep the username and passwords safe?**

For unregistered users, I currently forget username and password and put the `marksDB` into `$_SESSION`. When user is inactive for e.g. 30 minutes, marksDB is deleted. How safe are these data in `$_SESSION` ? And how about users that log in, view page once, and never view it again, so the script doesn't delete the marksDB from session? Is the session deleted automatically ([gc.maxlifetime](http://www.php.net/manual/en/session.configuration.php#ini.session.gc-maxlifetime))?

And what about registered users? I want to have everything safe, but I don't want to annoy user with password prompts every 30 minutes of inactivity. Is it safe to encrypt credentials like described [here](https://stackoverflow.com/questions/5089841/php-2-way-encryption-i-need-to-store-passwords-that-can-be-retrieved), but without the third user-set password? Or have I to ask the user for his password every time?

**EDIT:**

Thanks for quick replies,  

@Justin ᚅᚔᚈᚄᚒᚔ : I doubt they have some API, but I can ask them, just for case  

@Abid Hussain: Thanks for very useful links. (Thanks both for answers too).  

I will throw users' credentials away and have only parsed `markDB`, which I will probably throw away too (after logout or inactivity) - it is cheap to retrieve marks again when needed.