Setting sessions variables

Let me get this straight - if register_globals is set to off, the best way to assign a value to a session variable is to use: $_SESSION['varname'] = 'value' ; This both creates the variable and sets it. And then I can access this from any page (that has session_start() at the beginning) with: $somevar = $_SESSION['varname'] ; // or whatever Is that right? Is it really that simple? And is it true that it is best to keep register_globals off because there is some security implication? (I've got a feeling my hosting service insists on it). Info gratefully received... +a Steve