I have a PHP application in which user can login from mobile application and can do certain tasks. Mobile application works in the following way
User logs in from mobile application by sending email and password to PHP login page.
PHP login script validates the user and sends response back as success or failure.
If login succeeds, user can access other data by sending his customer id to php script and php script in turn sends response in xml format.
I want to make it more secure by using security token, which will be generated at login time and user has to send it to php script along with his customer id.
Where should I store the security token, and how can I match this with the token coming from the mobile app request?