PHPSESSID disclosed in URL?

Setup: PHP 4.1.2 + Apache 1.3.23 + PostgreSQL 7.2 register_globals=off, method=post; register_argc_argv=off; magic_quotes_gpc=off; using: $_SESSION[] and $_POST[] Now for the question (and I'm asking this because of my limited understanding on security measures): Each script page begins with "session_register();", and all works well. However, when I first fire up my website locally, I see something similar to: http://localhost/rap.php?PHPSESSID=a2604374903c616c9cd34e13c0ceed98 I understand that this is the session id, but why is it displayed in the URL? That doesn't strike me as a very safe idea! Am I wrong in being concerned, or am I turning paranoid? I am concerned since no other argument appears in the URL except this one. (Btw, I've also have "$session=session_id()" at the end of each script to pass the variables from other pages. Would this cause a security hole?) Any advice or insights would be greatly appreciated, Tia, Andre -- Please pray the Holy Rosary to end the holocaust of abortion. Remember in your prayers the Holy Souls in Purgatory. May God bless you abundantly in His love! For a free Cenacle Scriptural Rosary Booklet: http://www.webhart.net/csrb/