Take the 2-minute tour ×  I'm writing a new website with php and
I will be using cookies to track user session data. Before I
finalise the design I want to make sure that the site is not
vulnerable to attacks. I have written a list of attack methods
and come up with counter measures for each one. Can anyone think
of any more attack methods and if so also propose suitable
counter measures?  a list of all attack methods I could think
of:    1. guess/bruteforce session cookie   2. steal session
cookie (eg if the attacker saves the session cookie to usb)   3.
cross site scripting   4. phishing (session fixation)   5. sql
injection   6. http header injection  It should be noted that I
will be using my own database to store session info - not the
php standard session functions. When I detect an attack I will
run a function called warn_and_halt() which will log the attack
and inform the sysadmin, then halt the session under attack.  My
counter measures for each of the above attack types are:    1.
rather than using