Is this safe enough for user login and verification? (PHP, MySQL, Sessions) -

just want make sure have not missed obvious. need guys expertise on this.

user data in database: - password stored crypt() salted salt string stored in user table.

sessions: - when user logs on correctly create new row in sessions table unique sha256 hash session id. store user_id there see session exists user. - create cookie store session id in. - session removed when user logs out accessing logout function. - session automatically deleted on defined expiration time (e.g. 7 days)

authentication: - check if client has cookie session id in it. if cookie session id matches session id in sessions table, user authenticated.

what guys think? need else it?

edit: added method generate password:

public function generate_salt($password) {     $cost = $this->config['user__password_encrypt_cost'];     $salt = strtr(base64_encode(mcrypt_create_iv(16, mcrypt_dev_urandom)), '+', '.');      // prefix information hash php knows how verify later.     // "$2a$" means we're using blowfish algorithm. following 2 digits cost parameter.     $salt = sprintf("$2a$%02d$", $cost) . $salt;      // hash password salt     $hash = crypt($password, $salt);       return array(         'salted_password' => $hash,         'salt' => $salt      ); } 

"safe enough" little difficult answer here other things consider:

1. salt strength -- username or random value or time stamp? prefer latter two.
2. are requiring ssl when password sent on wire? consider doing this.
3. is cookie 'secure' , 'httponly' mitigate csrf? if can (depends on client support).
4. are employees restricted accessing both salt , encrypted value? restrict has access sensitive information.
5. which encryption algorithm , how many bits? try des 512 or stronger.
6. do enforce password strength requirements? should!
7. is db connection secure? important if db link on wan.