亚洲国产日韩欧美一区二区三区,精品亚洲国产成人av在线,国产99视频精品免视看7,99国产精品久久久久久久成人热,欧美日韩亚洲国产综合乱

The simplest login status is the session, and it is very safe.
Along with the session, there are cookies. Relatively speaking, it is not as secure as the session, but if it is set up, there will be no security issues.

Personally, I think the method of using $_SESSION to determine whether the user is logged in is unreliable.
For example, after a user changes his password, how can the program make the old login invalid?
So it is still recommended to use cookies to verify the user's identity.
In the cookie Save the user's ID and salt.
When the user registers successfully, or when the password is changed, the salt is regenerated and the user table is updated.

session is relatively simple, but not reliable enough; if you need more reliability, you can refer to WeChat/QQ, and for more reliable information, refer to online banking login.

session exists

This is unreliable because the session is stored in the cookie and is the content of the client. In principle, the server should not trust any information from the client and needs to be validated. As for the verification logic, please design it yourself (just judging "yes" and "no" is obviously not enough)