What are best practices for handling session IDs in PHP login systems?

Session IDs in PHP login systems should be handled securely to prevent session hijacking or session fixation attacks. One best practice is to regenerate the session ID after a successful login to prevent session fixation. Additionally, it is important to store session IDs securely, such as using HTTPS and setting the session cookie to be secure and HttpOnly.

// Start the session
session_start();

// Regenerate session ID after successful login
session_regenerate_id(true);

// Set session cookie to be secure and HttpOnly
ini_set('session.cookie_secure', 1);
ini_set('session.cookie_httponly', 1);