User ID, session data and security

[eluser]Jaketoolson[/eluser]
I'd like to echo what everyone has suggested thus far. I've always stored a unique_id to each user in the DB. When querying the user_db, I reference this unique_id rather than the auto_increment value or anything else. Users are hashes in my queries, not people!

Why not create a MySQL table which utilizes the MEMORY storage engine? It's 30% faster than myisam and 50% faster than innodb. Downsides to MEMORY? If the DB goes down, everything in tables using MEMORY engine is dumped but this is why it's good for storing session data. And lets be honest, if the db goes down or offline randomly, session data is the least of your concerns.
http://dev.mysql.com/doc/refman/5.0/en/m...ngine.html

HTML 5 finally has local storage - better than cookies in that they are easier to iterate through and utilize.
http://diveintohtml5.org/storage.html