A few questions about general security

[Goldeneye]

Type-Casting

My Login script sets $_SESSION variables upon authentication, would it be any different to just type-cast all the $_SESSION variables upon authentication or type-cast them whenever being used in an SQL-Query?

<?php
//At this point the user has been properly authenticated and the $_SESSION variables will be set
// the general-variables were pulled from an SQL Query
//THIS
$_SESSION['generatedID'] = (int)$generatedID;
$_SESSION['registeredUsername'] = $registeredUsername;
$_SESSION['UserPermissions'] = (int)$UserPermissions;
session_regenerate_id();
//OR THIS ?
$query = mysql_query("SELECT * FROM `generic_table` WHERE `generatedID`=".(int)$_SESSION['generatedID']."")
?>

 

Session Security

I'm quite paranoid about session security, though I haven't paid much attention to it yet. I'm aware using session_regenerate_id() is one method to prevent session-hijacking and/or session-fixation, but when/where do I use this in my script?

For example, where I use it right now is after the user hits the login button and only if valid credential were submitted. So it sets the $_SESSION variables and then the session_regenerate_id() is called.

 

*As seen in the above sample code, it is the last thing that executes in the script (when the form is being processed).

 

What else can be done to protect against session exploits?

 

Using $_GET variables for redirection

For my login script, I have a system that redirects the user to a location as specified by the $_GET['redirect'] variable. So if "http://foobar.com/login.php?redirect=foobar.php?id=2" was set, it would redirect the (authenticated) user to "http://foobar.com/foobar.php?id=2". I did use a $_SESSION variable before, but switched because a few quirks I couldn't fix. I know this definitely isn't a secure method, but does using urlencode() do enough to make secure? If not, what else can be done?

 

SQL Injections

Using something like mysql_real_escape_string() is sufficient enough for preventing SQL Injections isn't it? (I'm aware this is sort of redundant with my first question about type-casting).

 

 

Any advice/clarification is appreciated. A preemptive thanks to those who do.

[Goldeneye]

So, can anyone enlighten me on this?