From Chris Shiflett The Truth about Sessions
Nearly every PHP application uses sessions. This article takes a detailed look at implementing a secure session management mechanism with PHP. Following a fundamental introduction to the Web's underlying architecture, the challenge of maintaining state, and the basic operation and intent of cookies, I will step through simple and effective methods that can be used to increase the security and reliability of your stateful PHP applications.
It is a common misconception that PHP provides a certain level of security with its native session management features. On the contrary, PHP simply provides a convenient mechanism. It is up to the developer to provide the complete solution, and as you will see, there is no one solution that is best for everyone.
A very good article about how session should be treated with in PHP application.