PHP has built in session management that you could use - eg.
$_SESSION = something;
session_destroy(); <- when you want to end that current session
For your form action:
<?php echo($_SERVER[PHP_SELF]);> to mitigate xss
if you use this method, each session will assign a user-key on the users machine and when a session is opened elsewhere, it scans for that key - if it matches it accesses that session - if not then it starts a new session.
You can use
session_destroy() to kill all session data for that useror
session_unset(); to destory a particular session.
If you are using an sql database then you have to ensure that validation is being performed - otherwise you leave your web app open to a number of attacks, ie. XSS, SQLi, etc. which can leak out your users data, for a social media app / website that is very bad for obvious reasons. For a login field for example - something like this would be secure:
function clean($string) //custom cleaning with regex
$string = str_replace(' ', '-' $string);
$string = preg_replace('/[^A-Za-z0-9\-]/', '', $string);
return preg_replace('/-+/', '-', $string);
if(isset($_POST('submit'))) // built in sanitising
$sanitised_name = filter_input(INPUT_POST, 'username', FILTER_SANITISED_ENCODED, FILTER_FLAG_STRIP_HIGH);
echo $sanitised_name; // print out the sanitised name
echo .clean($_POST['username']).; // print out using the custom function
Above shows two different ways you can achieve very similar results with built in functions. the first block uses regex that you could restrict to whatever character set you wanted your users to use, while the second block uses the built in functions that PHP has - the end just echo's out so you can see the difference for whatever input you use.
EDIT: When storing your users usernames and passwords you should store the plaintext name in your database, but passwords should be salted and hashed, so rather than checking if a username and password matches, check if a username and password hash match what you have in your database - but make sure you set up a secure connection first before a user submits anything - otherwise they are sending information to your site unsecurely - quite easy for someone to MITM and steal credentials.
I actually wrote a paper that specifically deals with securing PHP, SQL, cookies and sessions from attacks like XSS, SQLi, session hijacking etc. if its any use to you i'll leave a link to it below since it goes into more detail: https://github.com/TheresAFewConors/Security/blob/master/Web%20Application%20Security.pdf Just as a disclaimer I don't work in security - i'm a student studying compSec but hope to work in the industry in the next couple of years - if there's anything missing or better than my answer ill happily edit it to improve it since some people on here are extremely knowledgable!
Good luck with with the social media app and website - its good to see that you are wanting to make it secure from the start!