title: Is this safe enough for user login and verification? (PHP, MySQL, Sessions)
body: <p>Just want to make sure I have not missed anything obvious. Need your guys expertise on this.</p>
  
  <p>User data in database:
   - Password is stored as a crypt() that is salted with salt string that is stored in user table.</p>
  
  <p>Sessions:
   - When user logs on correctly I create a new row in a sessions table with a unique sha256 hash session ID. I store user_id there too to see what session exists to what user.
   - I create a cookie which I store the session ID in.
   - Session is removed when user logs out by accessing logout function.
   - Session is automatically deleted on a defined expiration time (e.g. 7 days)</p>
  
  <p>Authentication:
   - Check if client has a cookie with session ID in it. If the cookie session ID matches a session ID in sessions table, user is authenticated.</p>
  
  <p>What do you guys think? Do I need to do something else about it?</p>
  
  <p>EDIT: Added the method to generate the password:</p>
  
  <pre><code>public function generate_salt($password) {
      $cost = $this-&gt;CONFIG['user__password_encrypt_cost'];
      $salt = strtr(base64_encode(mcrypt_create_iv(16, MCRYPT_DEV_URANDOM)), '+', '.');
  
      // Prefix information about the hash so PHP knows how to verify it later.
      // "$2a$" Means we're using the Blowfish algorithm. The following two digits are the cost parameter.
      $salt = sprintf("$2a$%02d$", $cost) . $salt;
  
      // Hash the password with the salt
      $hash = crypt($password, $salt);
  
  
      return array(
          'salted_password' =&gt; $hash,
          'salt' =&gt; $salt
       );
  }
  </code></pre>