Is Session a safe place to store data ?

I don't understand why the users table must not be auto incremented. What's the problem in that? Ion Auth from Bed Edmunds is considered insecured?

No, Ion Auth is excellent. I don't understand your question. Who said the user_id (I presume you mean) should not be auto incremented?

Cartalote said:
Good - only store the user id in the session - which is a long randomized string - not an incrementing ID

I assumed it meant the user_id should not be auto incremented.