title: cookies, sessions , and security
body: <p>I came up with my own way to protect the moderators on my site. First, I know that a hacker could hijack my session. So what I did was to add a cookie to the moderator and set my algorithm on how to set and unset those cookies.</p>
  
  <p>First, precaution that I took is this when the moderator logs in:</p>
  
  <pre><code>        if('Moderator'==is_monitor($name))//function finds who is the user
          {
              ini_set('session.use_only_cookies',true);
              session_start();
              $password_hash = hash('sha256',$salt.hash('sha256', $pass));
              $_SESSION['mod_identify']=$password_hash;
              if(!isset($_Cookie['adderss']))
              {
                setCookie("adderss",$ip_address,time()+60*60*24*365*5,"/");
              }
  </code></pre>
  
  <p>Then I use this to reset the sessions on every page:</p>
  
  <pre><code>if(!isset($_SESSION))
  {
     start_session(); // all sessions should be reset with a new id
  }
  </code></pre>
  
  <p>The question is whether setting a cookie for many pages is a burden on the moderator?!?</p>
  
  <p>Do you think that my way is secure enough against session/cookie hijacking?</p>