It's much rarer to see $_SESSION or $_COOKIE nowadays. Most frameworks have session libraries that have some validation checks built in, handle csrf/flash messa

It's much rarer to see $_SESSION or $_COOKIE nowadays. Most frameworks have session libraries that have some validation checks built in, handle csrf/flash messages and easily plug into backends (being able to have sessions use redis, etc in 2-3 lines of config makes session handling soooo much easier. And you're less likely to run out of disk space :P). The main issue with $_SESSION was that it is very easy to create a giant multidimensional array and have inconsistent logic creating fields. Another advantage is to bring the session variable in line with that of other languages so that devs switching languages won't be WTF as often