What are common pitfalls when handling session IDs in PHP, and how can they be avoided?

Common pitfalls when handling session IDs in PHP include not properly securing the session ID, exposing it in URLs or forms, and not regenerating the session ID after a user logs in or out. To avoid these pitfalls, always use HTTPS to secure the communication between the client and server, store the session ID in a secure, HTTP-only cookie, and regenerate the session ID using session_regenerate_id().

// Start session and set secure cookie parameters
session_start();
session_regenerate_id(true);

// Set session ID in a secure, HTTP-only cookie
session_set_cookie_params([
    'httponly' => true,
    'samesite' => 'Strict',
    'secure' => true
]);