Running checks for cms

I'm developing a decent looking `CMS` with the `PHP framework` called `Codeigniter`. I'm doing checks on the every page that's inside the control panel to verify there is a session available and that the user id in the session is what is to be expected of a user id. I also verify that the user id does match one of the users in the database and I use that to gather user data and find out if data is returned about the user. I am curious to know what other kind of checks should I do to ensure a safe environment for my users and to protect my cms site. Any ideas?

A few things you can do by just editing your CI `config.php` file, set the following to `TRUE`:

$config['sess_encrypt_cookie'] = TRUE;
$config['sess_use_database'] = TRUE;
$config['sess_match_ip'] = TRUE;
$config['sess_match_useragent'] = TRUE;
//you may want to set the below to true (it's optional)
$config['global_xss_filtering'] = TRUE;

Also, I would recommend reading CI's [**Security**][1] and [**Session**][2] docs to make sure that you are utilizing them the way CodeIgniter intended.


[1]:

[To see links please register here]

[2]:

[To see links please register here]