add XSS
add csrf(cross site request forgery)
update csrf token, add class auth.
add SQL injection and prepared statement in mysqli
update instruction of csrf token functions
set and encrypt cookie with mcrypt
sign a cookie with hash functions
session checking and redefine session attrs after user login or logout
update session protection documentation
file upload
update file upload, setting max size, allowed types and extensions, move file from tmp to certain dir, sanitize filename given from users