In a new entry to his SitePoint weblog, Harry Fuecks has some comments and suggestions about PHP session security and how it could effect your site.

He gives these things to look out for is to just not provide much information about the user in the session itself. It might seem tempting to grab all of the information you can and cram it into the session vars, but that's also another large security hole that anyone with a bit of knowledge can access...