note 11515 added to session_start

You can also put all of your session variables in a container object and access them that way. That will solve the security problem of ppl adding ?admin=1 to the query string. Since you always will do if ($mysession_ojbect->admin == 1)... You also get the added benefit of not having to call session_register for each new var you want to add. Just add the var to the object on the fly and whamo, its saved. And reading your php scripts makes more sense. You can tell what is a session var by reading the code $mysession_object->foo = "bar"; vs. $foo = "bar"; can't really tell if $foo is a session variable by looking at it. http://www.php.net/manual/en/function.session-start.php