Protect from people bruteforcing the PHPSESSID
Depending of the attack, your code might be either may be more secure than the traditional use of PHP sessions.



If the attacker gets the session_id cookie from an XSS attack, he also gets access to the session_key one, and your code won't protect sessions from being hijacked. You can avoid this by setting the HttpOnly flag on your cookies, making them not accessible by JavaScript through document.cookie :


Using ini_set('session.cookie_httponly', 1); will configure PHP to add the flag on the session_id cookie.
Setting the seventh parameter of the setcookie function to true will set the HttpOnly flag on the session_key cookie. More information about all the parameters can be found on the official documentation : http://php.net/manual/function.setcookie.php




Anyway, that won't protect from the man in the middle attacks.
PHP has a function named session_regenerate_id which changes the current session id by a new one, making the hijacked cookies obsolete.

All you need to do is calling this function once you've started the session : http://php.net/manual/en/function.session-regenerate-id.php



If the attacked gets the session_id cookie from bruteforce, then your solution is indeed more secure, but you should still have a look to the two settings mentioned above.

Note that substr(str_shuffle(str_repeat('0123456789abcdefghijklmnopqrstuvwxyz', 5)), 0, 32); doesn't generate a true random lowercase alphanumeric string since each character won't appear more than 5 times. substr(str_shuffle(str_repeat('0123456789abcdefghijklmnopqrstuvwxyz', 32)), 0, 32); will work.



There are also more php.ini settings to add more entropy to PHP sessions ids :


The session.hash_function setting changes the hash function used by PHP to generate the id.
The session.entropy_file and session.entropy_length settings will tell PHP to use an external file as a source of additional entropy when generating the id.