Session hijacking is too easy
You dont even need SQL injections to hijack

- No session domain check
- No session token
- No check for magic_quotes (else stripslashes is dying for the script)
- No check for ascii special characters (mysql_real_string & htmlspecialchars isnt enough...)

All functions are public so you can call them by curl() or file_get_contents()