只使用会话登录是否安全？

Question

I have seen many scripts mixing sessions, with cookies and having two session names, the username or ID and the session ID.

Is this secure?:

    if ($this->login($username, $password))
    {
        // everything works..
        $_SESSION['name'] = $username;
    }

Why do you need to generate a new Session ID? Why mix cookies with it? and what are the best ways to do it to prevent most of the attacks?

Answer 1

1. You generate session id's for each unique user so no data is shared!
2. You use cookies to be able to use transparent sessions. So you don't have to pass the session id in every URL
3. Read some of the comments in this thread