PHP login security
<p>This is how I'm building a login system:</p>

<p><strong>Login:</strong></p>

<ol>
<li>Check username and password supplied by user with the database.</li>
<li><p>If username and password is correct, store <strong><em>only user ID</em></strong> in session, something like:</p>

<p>$_SESSION['userid']=$userid;</p></li>
<li><p>If User has checked the option to stay logged in, then set 2 cookies, 1 with userID and other hashed string.</p></li>
</ol>

<p><strong>To check if user is logged in:</strong></p>

<ol>
<li>Check if Session exists, the user is logged. <strong>is it ok?</strong></li>
<li>If session does not exist, check if both cookies, userID and hashed string exist.</li>
<li>If Both cookies exist, validate them.</li>
</ol>

<p>As the Session is stored in the server, is it secure to store only userID ? Can a user pretend to be other user and store his userID in the session and log in as him?
Thanks.</p>
