I am using randomly generated numbers as session variables to identify the sessions in a PHP application. To make further security proof what ways should I follow?
The best way to generate random tokens for security purposes in PHP is using
openssl_random_pseudo_bytes() to obtain some random bytes, and then
bin2hex to make them printable.
$token = bin2hex(openssl_random_pseudo_bytes(16));
You can safely use
$token for your session identifier, CSRF tokens, etc.