What potential pitfalls can arise when using sessions in PHP for login systems?

One potential pitfall when using sessions in PHP for login systems is session hijacking, where an attacker steals the session ID and impersonates the user. To mitigate this risk, it is important to regenerate the session ID after a successful login to prevent session fixation attacks.

// Start or resume session
session_start();

// Regenerate session ID
session_regenerate_id(true);