title: Is my login session secure?
body: <p>First time creating a login system for a webpage and I've been trying to read up about security but unsure if I'm doing it right.</p>
  
  <p>So far I have a username/password stored and the password is hashed with sha256 and a 3 char salt. if the username and password are correct then I make a new session id like this</p>
  
  <pre><code>session_regenerate_id (); 
  $_SESSION['valid'] = 1;
  $_SESSION['userid'] = $userid;
  </code></pre>
  
  <p>at every page I check</p>
  
  <pre><code>function isLoggedIn()
  {
  if(isset($_SESSION['valid']) &amp;&amp; $_SESSION['valid'])
      return true;
  return false;
  }
  </code></pre>
  
  <p>I use this to check for a correct user</p>
  
  <pre><code>$username = $_POST['username'];
  $password = $_POST['password'];
  //connect to the database here
  connect();
  //save username
  $username = mysql_real_escape_string($username);
  //query the database for the username provided
  $query = "SELECT password, salt
      FROM users
      WHERE username = '$username';";
  $result = mysql_query($query);
  if(mysql_num_rows($result) &lt; 1) //no such user exists
  {
    //show incorrect login message
  }
  //check the password is correct for the username found
  $userData = mysql_fetch_array($result, MYSQL_ASSOC);
  $hash = hash('sha256', $userData['salt'] . hash('sha256', $password) );
  if($hash != $userData['password']) //incorrect password
  {
    //show incorrect login message
  }
  else
  {
  //setup a new session 
  validateUser();
  //redirect to the main page
  header('Location: main.php');
  die();
  </code></pre>
  
  <p>if its false then they get sent back to the login page. is this secure enough?</p>
  
  <p>in the main page I also have html links</p>
  
  <pre><code>  &lt;li&gt;&lt;a href="main.php"&gt;Home page&lt;/a&gt;
  </code></pre>
  
  <p>so I need to end the php script on the main page when these links are used?</p>