title: Security when storing $_SESSION
body: <p>I stored my session like this :</p>
  
  <pre><code>$_SESSION['user'] = $_POST['u_name'];
  $_SESSION['pass'] = $_POST['u_pass'];
  </code></pre>
  
  <p>Is this secure ?</p>
  
  <pre><code>if( isset($_SESSION['user']) &amp;&amp; isset($_SESSION['pass']) ) {
  
      // user exists
  
  }else{
  
      // user does not exist
  
  }
  </code></pre>
  
  <p>Or should I check (in every file) if</p>
  
  <ul>
  <li><code>$_SESSION['user']</code></li>
  <li><code>$_SESSION['pass']</code></li>
  </ul>
  
  <p>are in database.</p>
  
  <p>Like this :</p>
  
  <pre><code>    // db connection
      $conn = new PDO('mysql:host='.$host.';dbname='.$dbname, $user_db, $pass_db);
  
      // query string
      $stmt = $conn-&gt;prepare("SELECT * FROM users WHERE uname=:u_name AND AES_DECRYPT(upass,'some_key') = :u_pass;");
  
      // execute
      $statement-&gt;execute( array( 'u_name' =&gt; $_SESSION['user'], 'u_pass' =&gt; $_SESSION['pass']) );
  
      // does it return something ?
      if( $stmt-&gt;fetchColumn() == 1){
  
          // user exists
  
      }else{
  
          // user does not exist
  
      }
  </code></pre>