What are some potential pitfalls or vulnerabilities when using sessions in PHP for user interactions?

One potential vulnerability when using sessions in PHP is session fixation, where an attacker can force a user to use a known session ID. To prevent this, you should regenerate the session ID after a user logs in or changes privilege levels.

// Regenerate session ID to prevent session fixation
session_regenerate_id(true);