    function storeSerializedSession($serialized_session_data, $session_id)
    {
        $doSession = OA_Dal::staticGetDO('session', $session_id);
        if ($doSession) {
            $doSession->sessiondata = $serialized_session_data;
            $doSession->update();
        } else {
            $doSession = OA_Dal::factoryDO('session');
            // It's an md5, so 32 chars max
            $doSession->sessionid = substr($session_id, 0, 32);
            $doSession->sessiondata = $serialized_session_data;
            $doSession->insert();
        }
    }
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.