title: PHP Checking User Agent and IP To Prevent Session Hijacking
body: <p>I'm trying to figure out how to prevent session hijacking. Here's what I was thinking of doing:</p>
  
  <p>Along with the user id session, add a user agent and user IP session too. Every time a page is loaded, these sessions will be checked to see if they match - will this be enough? For example:</p>
  
  <pre><code>&lt;?php
  
  $userIp = $_SESSION['userIp'];
  $userAgent = $_SESSION['userAgent'];
  
  if ($userIp != $_SERVER['REMOTE_ADDR'] || $userAgent != $_SERVER['HTTP_USER_AGENT'] {
      session_destroy();
  }
  
  ?&gt;
  </code></pre>
  
  <p>Thanks.</p>