[Ashley Byrom]

Hi

Well, I'm just making sure before I employ a CMS on my site...

I have a user log in that administrators can log into and the website would recognise they are admins.

All my content is loaded on an index.php page and I was thinking if I set a session to say an admin is logged in and then made the admin be able to edit the page via the index.php file would this be safe or is there a way for a user to manipulate sessions so users could randomly edit my site?

Thanks

[rallport]

hehe

They are quite safe as some pretty big cms' and apps use sessions for user management. I'd probs also protect the admin directory with a .htaccess file to give an extra level of protection.

But to put your mind at rest, you should have a read on the topic of session hijacking.

[sunwukung]

if you can, use a session handler to pop the session in a database table instead. Also, rename the session default (so it's not PHPSESSID).