PHP User System Security -

i have small internal website charity, it's staff login access documents , rota. although it's meant users on web it's public therefore i'm still thinking security. need opinions on following because i'm not experienced.

i've stored 2 cookies when user logs in. first user id , second cookie id people can't change user id , logged in cookie id needs match. it's compared database every page. problem cookie id random number take no time pc cycle through range of few hundred thousand combinations find matching id each user. how can stop this? php's uniqid enough?

what other attacks should consider, apart sql injection (already prevented)

thanks

store client ip of each session on server.
if client ip session changes, that's suspicious.

another thing give sessions lifetime.
like, invalidate session if nothing happened arbitrary amount of time.

last not least, store random id in session database , map user instead of storing user-id directly cookie.