What are the best practices for handling sessions in PHP, especially when using URLs?

When handling sessions in PHP, it is important to ensure that session IDs are not exposed in URLs to prevent session fixation attacks. To achieve this, you can configure PHP to use cookies for session management instead of URLs. This can be done by setting the session.use_cookies directive to 1 in your php.ini file.

// Set session.use_cookies to 1 in php.ini
session.use_cookies = 1;