What are the potential security risks associated with storing user credentials in sessions in PHP?

Storing user credentials in sessions in PHP can pose a security risk if the session data is not properly secured. To mitigate this risk, it is recommended to store only a unique identifier in the session and retrieve the actual user credentials from a secure data store when needed. 

// Set a unique identifier in the session
$_SESSION['user_id'] = $user_id;

// Retrieve user credentials from a secure data store
$user_id = $_SESSION['user_id'];
$user_credentials = getUserCredentials($user_id);

Keywords

session hijacking session fixation cross-site scripting SQL injection password hashing

Related Questions