note 31991 modified in function.session-id by jsheets

Regarding gmgiles comment: Relying on php's internal session management is dangerous, and one should always pass the PHP Session ID between pages. Unfortunately, PHP seems inconsistent in its ability to handle sessions without doing this. I have learned this the hard way, having written several web applications where I didn't pass the ID in situations where did not have control over the hosting environment. The applications worked fine when I wrote them, but later, when the server was upgraded by the ISP, the applications broke. The moral of the story is pass your session IDs. Your applications will be more robust, and your clients will be more content in the long run. --was-- Regarding gmgiles comment: Relying on php's internal session management is dangerous, and one should always pass the PHP Session ID between pages. Unfortunately, PHP seems inconsistent in its ability to handle sessions without doing this. I have learned this the hard way, having written several web applications where I didn't pass the ID in situations where did not have control over the hosting environment. The applications worked fine when I wrote them, but later, when the server was upgraded by the ISP, the applications broke. The moral of the story is pass your session IDs. Your applications will be more robust, and your clients will be more content in the long run. If you're worried about people stealing sessions, use SSL encryption. That should take care of the security issues. http://www.php.net/manual/en/function.session-id.php