Here\'s the code. It\'s a simple operation to check that a session ID isn\'t being spoofed by verifying the IP address:
session_start(); $session_ip_address = $_
it does assign by value, the reference & next to $_SESSION has nothing to do with your expression $_SESSION['x'] = $x;
&
$_SESSION
$_SESSION['x'] = $x;