title: How to enhance security of a website?
body: <p>Question 1 :
  Can I just use <code>$userid = mysql_real_escape_string($_GET['user_id']);</code></p>
  
  <p>Or I need to use the codes below is better?</p>
  
  <pre><code>function mysql_prep( $value ){
          $magic_quotes_active = get_magic_quotes_gpc();
          $new_enough_php = function_exists( "mysql_real_escape_string" ); //example. php &gt;= v4.3.0
          if( $new_enough_php ) { //php v4.30 or higher, undo any magic quote effects so mysql_real_escape_string can do the work
              if( $magic_quotes_active ) { $value = stripslashes( $value );}
              $value = mysql_real_escape_string( $value );
          } else { //before php v4.3.0.
              if( !$magic_quotes_active ) { $value = addslashes( $value ); }
          }
          return $value;
      }
  
  $userid = trim(mysql_prep($_GET['user_id']));
  </code></pre>
  
  <p>Question 2 : Do we really need to use <code>md5()</code> or <code>shal()</code> on the <code>$_SESSION['user_id']</code>? Why we need that? session hijacker can get the session id only, but he cannot get the session variable value right? If so, then I don't need to hash the value of <code>$_SESSION['user_id']</code> anymore right? For example :</p>
  
  <pre><code>if (isset($_POST['login'])) {
          if ($username==$user_username_in_db &amp;&amp; $hashed_password==$user_password_in_db) {
                  $_SESSION['user_id'] = sha1($user_id_in_db); //sha1 convert userid to crazy long characters
          }
  }
  
  $query2 = "SELECT id FROM user WHERE sha1(id)='{$userid}' LIMIT 1";
  </code></pre>
  
  <p>Question 3 : Since php session hijacking happen and I can't afford to use ssl/https, so I make the website request the user to submit password everytime they try to delete a message or friend, because the session hijacker may impersonate the user to delete his messages/friends. May I know is it dangerous if my website always ask user to input password? The password will be easier to be hacked? May I know session hijacker can only impersonate the user, but cannot steal the user's password right?</p>