How can PHP developers prevent session fixation attacks in their login scripts?

Session fixation attacks can be prevented by regenerating the session ID after a user logs in. This ensures that the session ID changes and invalidates any previously set session IDs, making it harder for attackers to fixate a session.

// Start the session
session_start();

// Regenerate the session ID
session_regenerate_id(true);