Question in regards to storing sessions in the database

[eluser]bastones[/eluser]
Hi all,

I'm trying to figure out why you would be required to store session data in the database for "added security"? As far as I understand a PHPSESSID is stored on the visitor's computer and when you verify that existence of $_SESSION['username'], PHP checks for the value of "username" that would be stored on the server corresponding to the PHPSESSID the browser sent to the server.

First of all, what is the difference between this and CodeIgniter's session system? Cause right now I don't understand why sessions are needed to be stored in the database or why otherwise "an old session could be restored by a user modifying their cookies" as stated in the documentation?

Could someone elaborate please.

Thanks,
Ben.