User Object and Security

I'm programming my first user interface with login and account management using PHP and I'm stuck on this issue. I'm just about to finish creating my method in creating new user accounts when a thought hit me about my design.

Here's what happens. When the user attempts to log in, the program takes the string (haven't filtered it yet) and checks to see if the user name and password provided is within the database using the user class I created. If the user is found in the database, the username is encrypted using an algorithm from another class, their credential levels are returned, and both values are stored with the user object on a $_SESSION variable. Another session variable is also created that mimics the valu开发者_运维技巧e of the credential level stored within the object. Should either be unequal to each other, then the session was tampered.

Now on the user class definition (method list), there are methods that allow for the decode and encoding of the encrypted username; wich brings me to my question. Considering the user object is defined by this class which holds these methods to decode and encode the username, would this be considered a security risk? This class will be the same one used for logging in general users, too so I'm not sure...

A username is seen as public info, in general.

The only cases I've seen restrictions is if/when you want other to limit seeing a list of your user(name)s.

In general, it's the password that you should be weary of.

Also, in the session you might want to save the user table row id instead of user name (this is so you limit an attacker from knowing who the user actually was). That said, this is again a minor forethought.

Encrypting passwords is a security risk, its a clear violation of CWE-257. You should be hashing passwords, and sha256 is a great choice. Further more, the only thing that needs to be stored in your session is $_SESSION['logged_in']=True. Storing a username/password in the session is a very bad practice. The default session handler will store this information in /tmp/SESSION_ID.