What are some potential pitfalls when using PHP sessions to identify users and store data?

One potential pitfall when using PHP sessions is the risk of session hijacking, where an attacker steals a user's session ID and gains unauthorized access to their account. To prevent this, it's important to regenerate the session ID after a user logs in or changes their privilege level.

// Regenerate session ID to prevent session hijacking
session_regenerate_id(true);