Paul, PHP's scoping rules make a little more sense if you know the history. The story is that early versions of PHP treated all variables as global, like primitive programming languages such as BASIC. The obvious danger of this is that any library function is liable to have a variable-namespace collision with the main code (particularly if different people are working on the different components).
One day Rasmus Lerdorf got tired of getting bitten by that shortcoming, and looked for an easy way to fix it. The answer was that functions got their own private namespaces, and could not "see" the global namespace. To allow a function to "see" specific global variables, the "global" keyword was added.
This is not how most programming languages work -- particularly C, which inspired much of PHP's syntax -- but it fixed the problem for Rasmus. The rest of us now have to learn that scoping in PHP is somewhat upside-down and the keyword "global" has a slightly different meaning that what you may be used to.
On your question about transparent session IDs, there are two ways of doing it.
One is to enable transparent SIDs in your server configuration. If that is turned on, PHP will scan all outgoing text for hrefs, and will insert the name=value pair for the session ID on the fly.
Or you can take the more common approach, which is to insert the constant SID (a constant, not a variable, so it does not have a $ sign) manually in any hrefs that you construct.
In both of these situations, PHP will first attempt to use cookies to manage the session identity token. If cookies are successful, the SID constant will be empty and no session ID name=value clutter will appear in the URL (you may, of course, insert other name=value pairs that you might want to propagate outside the session environment). If the user has for any reason disabled or cannot use cookies -- a braindead proxy server, for instance -- the SID constant will be populated and a longer URL will automatically be generated.
Hope this explains it.
