Security issues

Prevent XSS injection.
Use timeout to prevent brute force attack. Parameters in config/session file.