PHP - How To Prevent Session Spoofing And Session Hijacking?

I have my script protected against all types of sql injection, XSS injection, cookies and bots.
But now i want to know whats the best way of preventing session hijacking?
I know nothing can be 100% secured but i want to know how to prevent it
And u know it:
prevention is better than cure!

which is the best place to put this code :

Code: [Select]
if(isset($_SESSION['last_ip'])===false){
$_SESSION['last_ip']=$_SERVER['REMOTE_ADDR'];
}
if($_SESSION['last_ip']!==$_SERVER['REMOTE_ADDR']){
session_unset();
session_destroy();
}
like this :

Code: [Select]
class session {
public $user_on=false;
public $user_id;

function __construct(){
//make sure that javascript can not access session variable
ini_set('session.cookie_httponly',true);
session_start();
//set the last ip the user has logged on with
if(isset($_SESSION['last_ip'])===false){
$_SESSION['last_ip']=$_SERVER['REMOTE_ADDR'];
}
if($_SESSION['last_ip']!==$_SERVER['REMOTE_ADDR']){
session_unset();
session_destroy();
}
$this->check_login();
}

private function check_login(){
if(isset($_SESSION['user_id'])){
global $user;
$this->user_id=$_SESSION['user_id'];
$this->user_on=true;
$user->find_by_id($this->user_id);
} else {
unset($this->user_id);
$this->user_on=false;
}
}
}
OR :
Code: [Select]
function __construct(){
//make sure that javascript can not access session variable
ini_set('session.cookie_httponly',true);
session_start();
$this->check_login();
}

private function check_login(){
if(isset($_SESSION['user_id'])){
global $user;
                        [b]//set the last ip the user has logged on with
if(isset($_SESSION['last_ip'])===false){
$_SESSION['last_ip']=$_SERVER['REMOTE_ADDR'];
}
if($_SESSION['last_ip']!==$_SERVER['REMOTE_ADDR']){
session_unset();
session_destroy();
}[/b]
                elseif($_SESSION['last_ip']===$_SERVER['REMOTE_ADDR']){
$this->user_id=$_SESSION['user_id'];
$this->user_on=true;
$user->find_by_id($this->user_id);
                 }
} else {
unset($this->user_id);
$this->user_on=false;
}
}
}

Hello everyone,

I am trying to use only cookies so that session fixation is not possible. Unfortunately I can still log in when I disable cookies in Internet Explorer.

Am I doing something wrong? Or do I misunderstand the concept?

This is my code:

Code: [Select]
<?php

class Session{

private $username;

public function createSession($username){
$this->username = $username;

ini_set("session.use_only_cookies", 1);

session_start();
$_SESSION['username'] = $this->username;
return $this->username;
}

}

?>

I was asked to make new thread for this, so how do I use a session or something to restrict access to a page.....like if accounttype=Admin, stay here, all others go away......do you need to see code, or can you just give me an example.......