What are the potential security risks of using session cookies for login in PHP?

Using session cookies for login in PHP can pose security risks if the cookies are not properly secured. One potential risk is session fixation, where an attacker can set a user's session ID before they log in, giving them unauthorized access. To mitigate this risk, it is important to regenerate the session ID after a successful login to prevent session fixation attacks.

// Start or resume session
session_start();

// Regenerate session ID to prevent session fixation
session_regenerate_id(true);

// Set session variables upon successful login
$_SESSION['logged_in'] = true;
$_SESSION['username'] = 'example_user';

// Redirect user to dashboard or home page
header('Location: dashboard.php');
exit();