title: PHP - Session mismatch, different id and wrong user, hijack risk and a major security risk
body: <p>Found a major problem on my website. I found tha if I login with user A. it sometimes kinda does log in but actually doesn't. Then I login with user B -> enter the site. I log out and then go manually back to url where login is needed and it somehow goes in with user A. It seems that I have two (maybe could have more) session_id cookies on different tabs or there is a ghost session_id that comes active I don't know. Pulling my hairs here.</p>
  
  <p>Also found that, lets say I have a user dashboard and test page. With a little going back and forth with different credentials. I get this result:
  Dashboard echoes user A's id, test echoes user B's id or not id at all. What the heck I am doing wrong with my sessions?
  Login is done with AJAX. Login validation is the same on every page.</p>
  
  <p>COMMON FUNCTIONS:</p>
  
  <pre><code>    function validateUser($userid) {
      session_regenerate_id();
      $_SESSION['valid'] = 1;
      $_SESSION['usersid'] = $userid;
  }
  
  function isLoggedIn() {
      if (isset($_SESSION['valid']) &amp;&amp; $_SESSION['valid'] == 1) {
          return true;
      } else {
          return false;
      }
  }
  
  function logout() {
      $_SESSION = array();
      session_unset();
      session_destroy();
  }
  </code></pre>
  
  <p>LOGIN/DB:
  Login page:</p>
  
  <pre><code>    session_start();
  include 'include_files.php';
  
  if(isLoggedIn()){
      header('Location:loginrequiredpage.php');
      die();
  }
  </code></pre>
  
  <p>Login page sends username/password with AJAX to an controller php file that uses db functions as included file. It executes usercheckfunc() which checks user from db and then echoes succes or fail back to ajax.</p>
  
  <p>from db functions - part of user check function</p>
  
  <pre><code>//if user found from db and password hash match
  validateUser(**ID FROM DATABASE**);
  </code></pre>
  
  <p>Back in login page if ajax gets success message back, JS send user to login required url.
  <strong>Here's where mystery sometimes occur</strong> The browser acts like if i just logged in somewhere, but the login page is loaded again. Sometimes I can manually go to login required page via address bar. Sometimes if I logout/idle too long etc. and login with different username/password I get in as a wrong user. Entered as user A, See user B's data OR echo different userids on pages or echo id only on other page.</p>
  
  <p>LOGIN REQUIRED PAGE:</p>
  
  <pre><code>    &lt;?php
      session_start();
      require_once 'include_files.php';
      if (!isLoggedIn()) {
          logout();
          header('Location:login.php');
          die();
      }
  
  echo $_SESSION['usersid'];
  </code></pre>
  
  <p>Test page:</p>
  
  <pre><code>    &lt;?php
      session_start();
      error_reporting(E_ALL);
      ini_set('display_errors', 1);
  
      require_once 'include_files.php';
      if (!isLoggedIn()) {
          logout();
          header('Location:login.php');
          die();
      }
  echo $_SESSION['usersid'];
  </code></pre>
  
  <p>Is there a "best" way to manage sessions? Help is much appreciated :)</p>