What are the best practices for using session_regenerate_id() in PHP to maintain session security without compromising performance?

When using session_regenerate_id() in PHP to maintain session security, it is important to call this function after a successful login or whenever a privilege level changes to prevent session fixation attacks. However, calling this function too frequently can impact performance due to the overhead of generating new session IDs. To balance security and performance, it is recommended to call session_regenerate_id() only when necessary, such as during sensitive actions or when the session state changes significantly.

// Check if session ID needs to be regenerated
if (/* condition for when to regenerate session ID */) {
    session_regenerate_id(true);
}

// Continue with the rest of your PHP code