Yes sessions are a good way to log on and off... most professional website do this:
If by secure you mean 100% secure: No, but then there really isnt a way to do that you might try Apache SSL with sessions for a bit more security (if you are passing sensitive information back and forth ie credit card)
Code for sessions can be found at
http://www.php.net/manual/en/ref.session.php
http://www.phpbuilder.com/snippet/download.php?type=snippet&id=293
Well generating them if you use the session_start() and session_register() automatically creates a hash (user ID for you), setting a time out would be a good idea.
Should session ID's be made absolete... well, PHP does a good job of creating session IDs so you will never get 2 of the same IDs so you dont have to make them absolete.
Cookies are the best thing around for "tracking" users... since the HTTP protocol is a "give you info and forget you" protocol, cookies do the best job of keeping track of you: other methods would include some kind of string in your header (ex http://www.site.com?id=3dfo4995kf) or make a hidden field with the session id in it
If you let PHP determine session IDs then you wont have to worry about the last part
I could be totally wrong on some of this but... these are my thought on Sessions 🙂
