title: PHP Session Validation - Best Practices
body: <p>I have a database in which I store session ID's once they have been validated to a user. </p>
  
  <p>From a security standpoint, should I be checking the session ID against the session ID stored in the database for every protected page being accessed?</p>
  
  <p>If I do not do this, wouldn't it be possible for someone to hijack the validated session ID, and do a post with the necessary variables to access restricted pages?</p>
  
  <p>From a performance standpoint - if I should be checking the session ID against the database for every request, would it be significantly more efficient to store validated session ID's in their own text files instead of making so many database queries?</p>
  
  <p>Thanks in advance.</p>