This proposed system is a session handler used to maintain an authenticated state and your method of building session tokens is insecure.

For example,  using SQL Injection you can read most of the secret data from the database.  If you are using MySQL SQL Injection can be used to read files using the load_file() function which could be used to read the secret from a config file.

In general you should not reinvent the wheel when building a system.  I am sure your platform comes with a secure session handler because just about every web application will need one.

Session ID's should be purely random values and an entropy pool like /dev/urandom is an excellent choice.  Just because you are using the platform's session handler doesn't mean its configured properly.  I recommend reading the OWASP Session Management Cheat Sheet.

Is my session-less authentication system secure?
The application I'm working on has simple functionality, but has one requirement that's giving me trouble. The application will be run from a thumb drive, and requires access to write a file to said thumb drive, so browser-based javascript/html is out.

My ideal goal is to have a single script that can be double clicked from mac's finder or windows explorer that will kick-off the update of this file that is stored on the usb drive. Is this possible?

I've come across similar questions (OK Programming language from USB stick with no installation), but everything I've found would still require separate starting points for each script. For example, if I put Lua binaries on the usb stick I will have to have a separate script for each platform I want to support.
