Are PHP sessions stored in /tmp on shared hosting safe?

Question

I have heard that there are security problems that arise because of this. Would it be wise to use purely databases for storing PHP sessions rather than in /tmp?

Answer 1

They are unsafe (although the Suhosin extension can encrypt them, providing a little bit of security). You shouldn't need to switch to a database just because of this (although there are other valid reasons to do so). The easiest way is to just set session.save_path to a directory only you can access.