Php session fixation example and fixes

Question

My question is about this summary on session fixation:

• Alice has an account at the bank http://unsafe.com/. Unfortunately, Alice is not very security savvy.

Answer 1

I don't fully understand, is this a really problem?

Q1. I think you need to check is there are a SID recieved from GET of COOKIE in you Session storage already (for example, in database). If YES - its'okay, if no, create a new one on server side and do http redirect with new SID.

Q2. I don't use a php 5.4 but i think the following code will help:

unset($_GET['sid'])

Update: I think the common fix is than only the backend-server can generate a SID identifiers. No user posibilites for this!