Is it best practice to store session files in a directory within the web root directory in PHP?

It is not considered best practice to store session files within the web root directory in PHP as it can pose a security risk. It is recommended to store session files in a directory outside of the web root to prevent unauthorized access to sensitive session data.

// Set the session save path to a directory outside of the web root
session_save_path('/path/to/session/directory');