<p>Sessions in PHP seemed to have changed since the last time I used them, so I'm looking for a simple way of using sessions but at the same time for it to be relatively secure and a good common practice.</p>

First off, use cookie based only unless you have a very specific good business reason not to. I had a client that insisted on url based sessions only for a project. very insecure and a pain to work with.
One good idea is to regenerate the session on each request. this makes hijack much less likely. For example.
```
```
session_start();
$old_sessionid = session_id();
session_regenerate_id();
$new_sessionid = session_id();
```
```
Another thing that is good practice is if you are doing some kind of user login as part of the system, completely invalidate and empty the session data on a logout to insure that the user is truly logged out of the system. I have seen systems where logout is just accomplished by removing the session cookie.