NYCPHP Meetup

[csnyder]

Hmmm, not sure how you would attack session vars, which are stored on
the server. Perhaps the security folks could elaborate. At best, you
could discover or fake someone's session id, but if you can do that,
you can gain access to any web application.

To undigress, session vars are the perfect place to store this info in
my opinion. If it saves you a select across a huge member table, all
the better.

As to #4, I would definitely keep your functions/methods as abstract
as possible, so as not to limit your code to working with PHP's
built-in session mechanism. Then again, It *can* be annoying to type
$_SESSION on every function call...

  chris.