php - What would be good UserManagement practices for a multi-platform WebApp -

i'd advice on used robust frameworks/code (ror, zend, symfony, django..).

i use user management system (understand: login, logout, user logged, user_id, username, etc..;) simple et tiny framework (usercake). i'm refactoring code, making api iphone/androi/js use , i'd refresh piece of code. need know if rearrange classes, dependencies, classes , keep same process or if need change things.

current state of play
after user signin, retrieve data, serialize it, create sessionid. store sessionid in user cookie , serialized data on db table links sessionid , data.

then, on website, each time page requested, retrieve db serialized data matching sessionid user has in cookie/session. make query sure username , hashed password matches in db , user still active (not banned or removed). same made api (the iphone, android, js must give me sessionid).

i've got cronjob deletes session table 1 expired. when user logs out, it's same, delete line in db , clear user cookie.

what i'm looking for
explained above seems me. secure enough ? needed double db check each time fine w/ username , password, can't trust serialized data in session table?

how done in famous frameworks (django, rails, symfony..)?

first:

after user signin, retrieve data, serialize it, create sessionid. store sessionid in user cookie , serialized data on db table links sessionid , data.

when "retrieve data" wasn't database already? why serialize data , put part of database? why not store user id in session variable, , use query user info may need?

second:

i make query sure username , hashed password matches in db

where getting username , password each request test against db? sounds though testing user , pass store serialized in db against original info in db. if so, match, set yourself.

third:

why use cron job remove expired sessions? sessions have built in expiration mechanism.

typically, want secure session using fingerprinting and/or trending. can save user's primary db key in session variable, , use each request retrieve user data may need. also, shouldn't need create session id , store in cookie yourself. php handles mechanism when call session_start(), , store session variables want save in $_session superglobal array. of frameworks mentioned open source, if want, can through code , see do.