What must be called immediately after a successful login to prevent session fixation?
- A session_destroy()
- B session_regenerate_id(true)
- C session_unset()
- D session_write_close()
Answer
session_regenerate_id(true)
Regenerating the session ID ensures an attacker who set a known ID before login cannot use it afterwards.





