It's definitely way too easy to get crypto wrong especially if you don't have the basic cryptographic knowledge as you note. I think it is much better for developers to just try and use existing proven solutions and not try to make their own crypto solutions. I've worked on one project where it was possible to use the sessions that came with the web server (tomcat) which were implemented securely. however, instead we decided to do extra work to roll our own sessions which were implemented incorrectly using the database rand() function.