title: using mysql to track sessions instead of trusting the server?
body: <p>Some context...skip to the bottom for question if you are impatient...</p>
  
  <p>I am trying to limit access to four pages on my (future) website to users with a valid username and password pair. To this end, I have a simple PHP/HTML form...in my PHP/HTML form the client types in a username and password, hits 'submit'...the data goes to POST and another PHP script validates the user/passwd pair by using a SELECT in my mySQL database...</p>
  
  <p>userpassword table:
  uid (PRIMARY KEY,INT), username (varchar 32), password (char 128)</p>
  
  <p>If the match works then it looks up the access table to see what page that particular username has access to (1 for access, 0 for no access):</p>
  
  <p>useraccess table:
  uid (PRIMARY KEY,INT), securename0(TINYINT), securepage1(TINYINT)...</p>
  
  <p>The PHP script then prints out links to the secure pages they have access to. If I understand them correctly, the articles and books I have read state that you normally store a cookie on the client side with a session ID that points to a session file on server that stores the username/password pair and whatever other session variables until it either times out or the user logs out.</p>
  
  <p>I don't want to spend the money for a dedicated server. So all that PHP session info is saved all lumped together on the server, along with the other half dozen websites from other customers running on it. This strikes me as horribly insecure...</p>
  
  <p><strong>The <em>question</em> is...would it be any more secure to circumvent all that and store/track the per-user session information in my own mySQL table?</strong> ie. something like this:</p>
  
  <p>session table:
  sessionkey (PRIMARYKEY, CHAR(128)), uid(INT), expiretimedate(DATETIME), accesstosecurepage0 (TINYINT), accesstosecurepage1(TINYINT)...</p>
  
  <p>So when a user hits any "secure" page it would check their session id cookie (if present) and then do a SELECT on the session table to see if that particular "sessionkey" is present, then give them access depending on what accesstosecurepage0,1,2,etc. are set to.</p>
  
  <p>Would this work better than the alternative or am I wasting my time?</p>