php - Logging user with sessions -

this question might seem bit imbecile wanna know either doing right or wrong.i have website of mine require user login.depends on user if want log in order or want surf website.now , doing whenever user log in make session of user instead of cookies.i store name , email of user inside sessions , use sessions check mechanism if has logged in.now questions follows:

1) sessions safe mechanism authentication?

2) have page named user_profile shows user's profile such name, address etc.i using email session variable check corresponding email database , display on user_profile page.is correct way of doing or should pass email post method other page?

note :

1. don't want use cookies.so please don't advise me store cookies time being.

2. have used prepared statements make sure queries sql injection proof(if not 100% still less prone sql injection)

you'll have better luck , more security storing sessions against unique hash instead of email , username.

you can store unique hash in database (or other form of storage) against username , email, way securing requests potential data leakage in event of sort of hijack.

something following work:

$sessionid = hash('sha256', $username . $email . $timestamp . $salt);