The risk is that if the hacker knows the sessionid of another user, the hacker can easily take over the session by including something like PHPSESSID=sessionid in the URL.
Sessionids are not easily guessed. However they can be obtained by cross-site-scripting or javascript injection exploits.
Here's some code to fight session hijacking very effectively:
session_start();
if(version_compare(‘5.1.0’, phpversion(), ‘>’)) {
session_regenerate_id(TRUE);
} else {
unlink(ini_get(‘session.save_path’).’/sess_’.session_id());
session_regenerate_id();
}
Just replace your existing call to session_start() with the code above. It works by generating a new sessionid on every request, thus making obtained sessionids useless.
