im suprised that nobody responded to your question earlier. sessions are stored on the users machine (like a cookie... in fact sessions ARE cookies).
sessions are pretty safe, but a good idea would be to store the visitors username and password (encrypted if you want added security) in session variables. Check this during each page load so no user could get another users data (this could only happen if the two users were using the same computer). Make sure to include a log-out feature which sets all the variables in the session to null. by calling session_destroy().
On the top of every page that you want the session to exist (above <html>), type:
<?php
session_start();
?>
To create a session variable, type
session_register("variableName");
$variableName = "value";
On the next page, to print the value of variable name, type the following:
session_register("variableName");
echo $variableName;
To remove just a single variable from the session, type:
session_unregister("variableName");
hope i was of some help....
-Matt
