存储会话以供会员区使用
我为我的会员区创建了一个注册/登录系统。用户登录后，我想存储一个会话变量，我可以使用该变量从数据库检索与用户关联的数据。
我应该以任何方式加密变量吗？我想要作为变量的数据是用户名或 ID，哪个最好？
是否应该以任何方式以及何时重新生成会话 ID？
I have created a registration/login system for my members area. Once the user has logged in I want to store a session variable that I can use to retrieve data associated to the user from the database.
Should I in encrypt the variable in any way? The data I want as a variable will either be the username or the id, which is best?
Should session ids be regenerated in anyway and when??
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
会话中的数据存储被认为是“安全”的，因此您不需要对其进行加密解密。
Data storage in session is considered to be "safe", so you dont need encrypt-decrypt it.
成功登录/注销后，您应该重新生成会话 ID。出于安全原因，如果用户想要执行关键操作（例如更改重要数据、删除帐户或提交订单），我建议询问用户密码。
正如 AurimasL 所说，您不必担心服务器端的会话数据。如果您在共享主机上，我建议您阅读此内容，因为存在一些安全方面的问题： http: //phpsec.org/projects/guide/5.html
You should regenerate your session id after a successful login/logout. For security reasons, I would reccomend to ask the user for his password if he want's to perform a critical action (changing important data, deleting account or submit an order for example).
As AurimasL stated, you don't have to worry about session data on the server side. I reccomend this reading, if you are on a shared host, because then there are some security aspects: http://phpsec.org/projects/guide/5.html
会话 ID 像 cookie 一样存储在客户端计算机上，并针对每个请求传递回服务器。这就是 PHP 在收到请求后确定将哪些信息加载到会话中的方式。
由于会话存在于服务器上而不是客户端上，因此您只需要担心会话劫持关于其中存储的信息是否安全。您的问题的答案是否定的，我不会尝试加密会话中存储的信息。
Session IDs are stored like a cookie on the client's machine, and are passed back to the server for every single request. This is how PHP determines what information to load into a session once it receives the request.
Since sessions live on the server and not on the client, you only need to worry about session hijacking in regards to whether the information stored in them is secure or not. The answer to your question is no, I would not try to encrypt the information that is stored in session.
只需在下面的评论中添加，
请记住，创建会话对于您的服务器应用程序来说是昂贵的。有时，将 id 存储在会话中，将其他信息存储在 cookie 中（不需要像用户名一样安全的信息）是一个好主意。
Just an add in the comments bellow,
Keep in mind that creating a sessions are expensive for your server app. Sometimes is a good idea stores the id in the session and other informations in cookies (informations that dont need security as the username).