note 17020 added to ref.session

If someone has access to www site (PHP) and (on the same server) private home page(PHP) - in private dir. If ha know the session name, he can: - login into www site (form window 1), - run his own PHP script (window 2 of explorer, from home directory) and manage all the session vars. Is this right ? How to change it so that only sites in location xxx can: session_start()? -- http://www.php.net/manual/en/ref.session.php http://master.php.net/manage/user-notes.php?action=edit+17020 http://master.php.net/manage/user-notes.php?action=delete+17020 http://master.php.net/manage/user-notes.php?action=reject+17020