Description:
------------
The SessionHandleInterface example allows users to read or write arbitrary files on the system by passing an evil session id:


function read($id):

    file_get_contents("$this->savePath/sess_$id");


function write($id):

    file_put_contents("$this->savePath/sess_$id", $data);


$id is the value of the SESSID cookie and it is allowed to contain any string, including "/../var/www/backdoor.php".

Since this is a documentation example, users are expecting it to be correct, and might copy/paste it as-is.