I am wondering what the risks are of storing the userid in a session?
then simply doing a
if(isset($_SESSION[\'user_id\'])){ login_user($_SESSION[
Most applications use $_SESSION as you are. If there where a wide spread weakness then major projects would be doing things differently.
$_SESSION