Because of my lack knowledge in technical English, I still don't understand about session hijacking & fixation.
Have anybody enlightenment me about this, especially by this code I wrote below:
<?php
session_start();
if (!$_SESSION['auth'] == 1) { // '1' is OK to login
header('login.php'); // go back to login page
die();
} else {
?>
=== the protected page ===
<?php
}
?>
in the cookie, I only write username only without password.
How can I make this snippet safer?
Thx
