function phpAds_SessionStart()
{
	global $session;

	if (empty($_COOKIE['sessionID'])) {
		phpAds_clearSession();

        $sessionId = phpAds_SessionGenerateId();

        $dal = new MAX_Dal_Admin_Session();
        $dal->storeSerializedSession(serialize($session), $sessionId);
	}

	return $_COOKIE['sessionID'];
}
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.