If at all possible, don’t put your sessions under your www directory – as you said, this exposes them to the outside world. Not good!

If you must put your session directory under www, definitely password protect it with htaccess. There’s probably even a “no access” directive you can put in your .htaccess file.

my only question, with this hack, i am now moving my session files to a www/ folder. i can password protect it i guess, but it is now open to public hacking.

do you know what safeguards i can use in this case?