So, I know this has been done to death but all the answers I've come across have been extremely confusing/contradicting each other or their explanations have been incomplete and I'm trying to keep up and do this my self using all the resources available but I think I've gotten lost somewhere. I would like to clarify this once and for all. Thank you for your patience in advance as this may end up being a little bit long winded.
I have a small login box at the top of my page which will remain constant if the user is not logged in. If they are logged in, then instead of a login box, they will see a greeting with their name in it.
Session Checking
So first of all, here is a diagram of (to my understanding thus far) how to check the user can access 'members only' content. (this code goes at the top of the page to check and set variables such as $loggedin = true;)
As it stands, my $_SESSION['loggedin'] is just the users name. It's to my understanding that sessions can be faked or hijacked from the same domain and so I know this is very insecure (for instance an attacker could somehow make a session containing a different users name and voilà - instant access to that users stuff) But I don't know how I should be checking the session. The only way I can imagine to do this is to connect to the database every time a page is loaded and check an MD5 hash or something from the database (And renew it) but I imagine this would generate a lot of needless server traffic and i'm almost sure there's a better way to do it.
Logging in
Here is a diagram of what happens when a user logs in (And whether to display the greeting or the login box.)
For the most part i'm pretty solid on this part (I hop