Why is it always recommended that session_regenerate_id() should be used before the user's session is created.
As per my perception, session_regenerate_id() should be used once the user session id is created (when the user is logged in), and we need to re-generate it so as to mitigate the session fixation attack by the hacker.
Please suggest!!
