What are some potential pitfalls to be aware of when using session variables in PHP?

One potential pitfall when using session variables in PHP is the risk of session fixation attacks, where an attacker can set the session ID to a known value and hijack the user's session. To prevent this, you should regenerate the session ID whenever the user's privilege level changes, such as during login or logout.

// Regenerate session ID to prevent session fixation attacks
session_regenerate_id(true);