What are the best practices for managing session IDs in a PHP application, especially in a shopping cart scenario?

To manage session IDs in a PHP application, especially in a shopping cart scenario, it is important to regenerate the session ID after a user logs in or performs sensitive actions to prevent session fixation attacks. Additionally, store session IDs securely using cookies with the 'HttpOnly' and 'Secure' flags to mitigate session hijacking risks. Regularly validate and sanitize session data to prevent injection attacks and ensure data integrity.

// Regenerate session ID after login or sensitive actions
session_regenerate_id(true);

// Store session ID securely using cookies
session_set_cookie_params([
    'lifetime' => 0,
    'path' => '/',
    'domain' => 'example.com',
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Strict'
]);

// Validate and sanitize session data
$_SESSION['user_id'] = filter_var($_SESSION['user_id'], FILTER_SANITIZE_NUMBER_INT);