How can an attacker exploit an outdated session ID in PHP and what measures can be taken to prevent this?

An attacker can exploit an outdated session ID in PHP by intercepting and using the old session ID to gain unauthorized access to a user's session. To prevent this, developers can regenerate the session ID periodically to invalidate old session IDs and mitigate the risk of session hijacking.

// Regenerate session ID to prevent session fixation
session_regenerate_id(true);