title: $_SESSION['ip'] and $_SERVER['REMOTE_ADDR'] security issue
body: <p>So I was just told (by one of my users) that my login wasn't secure and that a session could be pretty easily hijacked.</p>
  
  <p>Can anybody tell me why and how I can correct this?</p>
  
  <p>This is my user class:</p>
  
  <pre><code>  class User
    {
      private $_db;
      private $_isLogged;
  
      public function __construct()
      {
        if (!session_id())
        {
          session_start();
        }
        $this-&gt;_db = Db::init();
        $this-&gt;_checkLogin();
      }
  
      public function isLogged() 
        {
            return $this-&gt;_isLogged;
        }
  
        public function login($username, $password)
        {
        $sth = $this-&gt;_db-&gt;prepare("SELECT * FROM users WHERE username = ?");
        $sth-&gt;execute(array($username));
        $result = $sth-&gt;fetch();
  
        if ($result)
        {
          if ($result['password'] == md5($password))
          {
            $this-&gt;_setLogin($result);
            return true;
          }
        }
  
        return false;
      }
  
      public function logout() 
      {
        session_destroy();
        setcookie ("simpleLogin", "", time() - 3600, '/');
      }
  
      public function fbLogin($fbId)
      {
        $sth = $this-&gt;_db-&gt;prepare("SELECT * FROM users WHERE facebook = ?");
        $sth-&gt;execute(array($fbId));
        $result = $sth-&gt;fetch();
  
        if ($result)
        {
          $this-&gt;_setLogin($result);
          return true;
        }
        return false;
      }
  
      private function _setLogin($userData)
      {
        $_SESSION['logged'] = true;
        $_SESSION['id'] = $userData['id'];
        $_SESSION['username'] = $userData['username'];
        $_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
  
        try {
  
          $sth = $this-&gt;_db-&gt;prepare("UPDATE users SET ip = ? WHERE id = ?");
          $sth-&gt;execute(array($_SERVER['REMOTE_ADDR'], $userData['id']));
  
          $forCookie = array(
            'id' =&gt; $userData['id'],
            'ip' =&gt; $_SERVER['REMOTE_ADDR'],
            'username' =&gt; $_SESSION['username']
          );
  
          setcookie('simpleLogin', serialize($forCookie), time()+60*60*24*30, '/');
  
        } catch (Exception $e) {
          die('Database error: ' . $e-&gt;getMessage());
        }
      }
  
        private function _checkLogin()
        {
        $this-&gt;_isLogged = false;
  
        if (isset($_SESSION['logged']) &amp;&amp; $_SESSION['logged'])
            {
          $sth = $this-&gt;_db-&gt;query("SELECT * FROM users WHERE id = " . $_SESSION['id']);
          $result = $sth-&gt;fetch();
  
          if ($result['ip'] == $_SESSION['ip'])
          {
            $this-&gt;_isLogged = true;
          }
        }
        else if (isset($_COOKIE['simpleLogin']) &amp;&amp; $_COOKIE['simpleLogin'])
        {
          $cookieData = unserialize(stripslashes($_COOKIE['simpleLogin']));
  
          $sth = $this-&gt;_db-&gt;query("SELECT * FROM users WHERE id = " . $cookieData['id']);
          $result = $sth-&gt;fetch();
  
          if ($result['ip'] == $cookieData['ip'])
          {
            $this-&gt;_isLogged = true;
            $this-&gt;_setLogin($result);
          }
        }
      }
    }
  </code></pre>